PyPI now supports digital attestations

The Python Package Index (PyPI) has ("Index support
for digital attestations"). about the work and its adoption, as well as what is left
undone:

One thing is notably missing from all of this work:
downstream verification. [...]

This isn't an acceptable end state (cryptographic attestations have
defensive properties only insofar as they're actually
verified), so we're looking into ways to bring
verification to individual installing clients. In particular, we're
currently working on a directly into their pip install
flows.