PyPi did indeed, but it's a fairly interesting case. It was removed because the implementation was ineffective More information on that here: https://blog.yoss

PyPi did indeed, but it's a fairly interesting case. It was removed because the implementation was ineffective More information on that here: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI-worse-than-useless https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI... There was a lot of talk about why this didn't go the other way; keeping signing, but making the practice meaningful. I forget the details about that.