Secure PyPI downloads with signed repository metadata | Hacker News Reader