No, I don’t have those numbers on hand. If you upload from your local machine, none of this applies to you. It only applies to people using CI to upload, who wa

No, I don’t have those numbers on hand. If you upload from your local machine, none of this applies to you. It only applies to people using CI to upload, who want to reduce the overall scope of their shared access by not relying on permanent credentials. That’s the whole point of trusted publishing; it has nothing to do with locally initiated uploads. > I'd say that's a major design flaw of pypi, that it is impossible to create per-package scoped tokens directly, unless one is configuring trusted publishers (which translates to github). I think you’ve misunderstood. PyPI allows you to create project scoped tokens completely independent of trusted publishing. Trusted publishing is only distinguished in that the scopes are automatic, meaning that the user cannot overscope their token. The point about security modules is a red herring; it was supposed to emphasize that this is outside of PyPI’s domain of interest. But no, I do it for myself, not because my employer requires it.