[Python-Dev] Re: PEP 458: Secure PyPI downloads with package signing