PyPI signs uploaded packages with its signing key per PEP 458: https://peps.python.org/pep-0458/ https://peps.python.org/pep-0458/ : > This [PEP 458 security]

PyPI signs uploaded packages with its signing key per PEP 458: https://peps.python.org/pep-0458/ https://peps.python.org/pep-0458/ : > This [PEP 458 security] model supports verification of PyPI distributions that are signed with keys stored on PyPI So that's deprecated by PEP 740 now? PEP 740: https://peps.python.org/pep-0740/ https://peps.python.org/pep-0740/ : > In addition to the current top-level `content` and `gpg_signature` fields, the index SHALL accept `attestations` as an additional multipart form field. > The new `attestations` field SHALL be a JSON array. > The `attestations` array SHALL have one or more items, each a JSON object representing an individual attestation. > Each attestation object MUST be verifiable by the index. If the index fails to verify any attestation in attestations, it MUST reject the upload. The format of attestation objects is defined under Attestation objects and the process for verifying attestations is defined under Attestation verification. What is the worst case resource cost of an attestation validation required of PyPI? blockchain-certificates/cert-verifier-js; https://westurner.github.io/hnlog/ https://westurner.github.io/hnlog/ Ctrl-F verifier-js `attestations` and/or `gpg_signature`; From https://news.ycombinator.com/item?id=39204722 https://news.ycombinator.com/item?id=39204722 : > An example of GPG signatures on linked data documents: https://gpg.jsld.org/contexts/#GpgSignature2020 https://gpg.jsld.org/contexts/#GpgSignature2020 W3C DID self-generated keys also work with VC linked data; could a new field like the `attestations` field solve for DID signatures on the JSON metadata; or is that still centralized and not zero trust?