[Distutils] Re: PyPI & cryptographic signing and malware detection - seeking comment