Yes the packaging system has signatures but unfortunately Python's SSL implementation doesn't verify certificates, nor do its packaging tools. The signatures co

Yes the packaging system has signatures but unfortunately Python's SSL implementation doesn't verify certificates, nor do its packaging tools. The signatures come from the same server as the packages, so if someone MITMs the server you can still get hosed. There was a talk at last year's PyCon demonstrating this and these kinds of problems still have not been fixed.