Pypi.org is running a survey on the state of Python packaging
I didn&#x27;t take the survey because I&#x27;ve never packaged anything for PyPI, but I wish all of the package managers would have an option for domain validated namespaces.<p>If I own example.com, I should be able to have &#x27;pypi.org&#x2F;example.com&#x2F;package&#x27;.  The domain can be tied back to my (domain verified) GitHub profile and it opens up the possibility of using something like &#x27;example.com&#x2F;.well-known&#x2F;pypi&#x2F;&#x27; for self-managed signing keys, etc..<p>I could be using the same namespace for every package manager in existence if domain validated namespaces were common.<p>Then, in my perfect world, something like Sigstore could support code signing with domain validated identities.  Domain validated signatures make a lot of sense.  Domains are relatively inexpensive, inexhaustible, and globally unique.<p>For code signing, I recognize a lot of project names and developer handles while knowing zero real names for the companies &#x2F; developers involved.  If those were sitting under a recognizable organizational domain name (example.com&#x2F;ryan29) I can do a significantly better job of judging something&#x27;s trustworthiness than if it&#x27;s attributed to &#x27;Ryan Smith Inc.&#x27;, right?