Sorry I didn't intend to insinuate that pypi should necessarily accept any old tokens just because they're there. Just that increasingly OIDC is more and more an option, which is generally a good thing.

PKI definitely is still hard, but if it can be done well by a smallish number of trusted parties to the benefit of their users, this can have huge ecosystem benefits. Let's hope we live in that timeline.