ATTESTATIONS: A NEW GENERATION OF SIGNATURES ON PYPI

Summary from the TLDR InfoSec newsletter

PyPI has introduced digital attestations (PEP 740) to improve package security. Digital attestations offer better usability and verifiability than PGP signatures. Attestations are automatically enabled for publishers using Trusted Publishing with pypa/gh-action-pypi-publish v1.11.0+.