My signing keys aren't tied to obscure 'smart contracts' that execute code when I do things like try to delete them.

If you are pwned you can contact pypi and get it fixed