alt Hacker NewsIt would be even nicer if there were a way to have an attestation without publishing with a workflow controlled by one of the tech giants. There's no way for me, someone who has had a PyPI account for many years and has used it for all that time to upload packages, to attach my own public key to my PyPI account and then sign uploaded distributions with my private key so the signature can be verified and count as an attestation.
I think the problem is this type of attestation is hard to weigh as a trust signal, vs the cloud CI version.
Inherently, if someone steals your key, or gains access to a box that can use that key for signing, they are indistinguishable from you. Hand PGP signing also lacks time-bound signing, any ratchet mechanism, CT log, consistent key hierarchy, or standard to bind signer name and project identity.