[cordite]

Who will check the signatures when so few have signatures?

What dev thinks oh I can’t upgrade because of this error, stackoverflow says use this flag —disable-signature-verification so I do and now I can develop again

[flatiron]

Any place with a devops team would not disable that.

[progval]

For what it's worth, Debian packagers check signatures when downloading from PyPI.