PyTorch and the PyPI supply chain

re distros, too much plurality and too much complexity to get across the swathe when viewed in aggregate for a developer/publisher of a python dependency, ie language tools exist for a reason. i'd be willing to settle for simple signature upload and verification (sans gpg, say cosign) on the language repos.. but there has been a slow moving effort to try and make things better albeit glacial speeds.. https://blogs.vmware.com/opensource/2020/09/17/tuf-pypi-i... updates are scattered across internet/github issues / tulip chat logs. i do wonder if some of the ossf projects will help on the broader ecosystem. its unclear if we're not just creating another checkbox for enterprises sometimes vs actually moving the needle.