I use .deb packages mostly rather than pip. Signatures are checked if present, at least. Also packages that stop working because python removes stdlib modules

I use .deb packages mostly rather than pip. Signatures are checked if present, at least. Also packages that stop working because python removes stdlib modules that they use, tend to get found and patched in distributions. In pypi if they are abandoned, they will be unusable for all eternity.