PyPI is rolling out 2FA for critical projects, giving away 4k security keys

This is a great move. Another I'd love to see is a mechanism to encourage package maintainers to periodically audit who has permission to publish. Sometimes, usually without MFA, accounts that no longer need access get compromised. An easy interface to audit and revoke unneeded access is important.

Related:

https://news.ycombinator.com/item?id=32026624 "Atomicwrites' old versions have been purged from PyPI"

https://news.ycombinator.com/item?id=32037562 "Congratulations: We now have opinions on your open source contributions"