Removing PGP from PyPI
So they examined everything uploaded to PyPi with a signature over <i>three years</i>, including old versions, and classify those packages whose signing key is expired <i>today</i>, possibly years later, as &quot;impossible to meaningfully verify.&quot; Never mind that the package may have been verifiable with a valid key for a full year or two before the key expired, and in the meantime may have been superseded by a newer version.<p>They also say they can&#x27;t &quot;meaningfully verify&quot; packages if the key does not have &quot;binding identify information,&quot; by which they presumably mean automatically verifiable binding identity information, which usually means someone verified an email from keys.openpgp.org. This is a really narrow way to establish &quot;binding identity information.&quot; For example someone who is a PyPi author and publicly links their PGP key from a (https) website on the same domain as the email on the key would not count. A well known longtime PyPi author with a well known key would not count.<p>The ad hoc, out of band nature of how PGP keys are trusted is not remotely new - PyPi would have known from the very start of adopting PGP that many keys would not be automatically verifiable. It makes little sense to turn around now and act like this is some surprising thing.<p>This has the smell of &quot;we didn&#x27;t want to bother supporting PGP any more because it&#x27;s hard so we came up with an excuse.&quot;<p>No need for an excuse, though: Just be honest about it and let the chips fall where they may, if you really don&#x27;t want to support PGP. God knows there are valid reasons for not having the energy to deal with PGP. (FWIW I think it&#x27;s a good solution for packages, for those who can navigate the tooling, but on the other hand I&#x27;m not volunteering my time to run PyPi.)<p>P.S. There is a link in their post saying PGP has &quot;documented issues.&quot; The specific issue described in the linked document is &quot;packaging signing is not the holy grail&quot; and a list of known things about PGP, like that verification of keys is ad hoc. It also concludes that there is no known better alternative.