Kudos to PyPI for handling this professionally. That said, I think we should be working towards a world where they're unnecessary. As a middle party to what o

Kudos to PyPI for handling this professionally. That said, I think we should be working towards a world where they're unnecessary. As a middle party to what ought to be a developer/developer trust relationship, they're attack surface that threatens depender sometimes and dependee other times. Going peer-to-peer will be less convenient, but worth the investment in the long run.