Switch away from sigstore to

[captn3m0]

https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds.

seems like while pypa is still suggestion the python sigstore action, the github attestations are more native, so we should move there?

[captn3m0]

How I hate python ecosystem fragmentation. just after upgrading from pyscaffold, because the pypa setuptools links it pointed me to are dead after 3 years.

[captn3m0]

Waiting for pypi/warehouse#15871 is probably a good idea.

[webknjaz]

FYI, it's already possible to upload the attestations. I had to fix a minor bug in the action today but you can start uploading already if you use trusted publishing. Just bump to v1.10.1 and opt-in.