PyPI dropped existing support for digital attestations

That's a great article explaining how there's no evidence for it being a backdoor and quite a few reasons to believe it isn't. Thanks for linking it.