PyPI dropped existing support for digital attestations

This is a misrepresentation of the conversation on HN: PyPI is willing to support any Trusted Publishing provider that can a set of baselines around user volume and operational security. Those baselines exist because Trusted Publishing has no security benefit at 1-2 person scales; hence the comment about my basement server. "Large" does not mean "corporation."

The guidelines for what PyPI expects in a potential new provider are documented here: https://docs.pypi.org/trusted-publishers/internals/#how-d...

If a large NGO, nonprofit, or community organization wants to become a Trusted Publishing provider, they should file an issue and work with PyPI's maintainers on what implementation will look like.