Following "Best practice" is doing what everyone else does, just because everyone else is doing it. "Best practice" is cargo culting. Everyone's got different

Following "Best practice" is doing what everyone else does, just because everyone else is doing it. "Best practice" is cargo culting. Everyone's got different requirements and constraints. If one thing is apparent, it's that pypi doesn't have in a requirement that packages are signed, because no-one (publishers and clients) is currently using them properly. And yet, python (and pypi) is alive and popular. If that's the case, the "best" package signature scheme is none at all.