https://peps.python.org/pep-0480/
PEP 480 – Surviving a Compromise of PyPI: End-to-end signing of packages | peps.python.org
Proposed is an extension to PEP 458 that adds support for end-to-end signing and the maximum security model. End-to-end signing allows both PyPI and developers...
signing packagespepcompromisepypiend
https://github.blog/changelog/2026-04-08-new-pgp-signing-key-for-github-cli-linux-packages/
New PGP signing key for GitHub CLI Linux packages - GitHub Changelog
Apr 8, 2026 - We’ve published an updated PGP keyring for GitHub CLI’s Linux package repositories. The keyring now includes both the current signing key and a new replacement...
signing keygithub clinewpgplinux