[Distutils] Still no easy way to secure upload packages to PyPI