Please see [this posting](https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648/71?u=trishankatdatadog) for more context.