Removing PGP from PyPI (2023)

What’s the current best solution for associating a public key to an identity or person?

This is not related to cryptography protocols.

OpenPGP key server verifies email. Keybase was a good idea but seems dead. Maybe identity providers?

> Maybe identity providers?

That's essentially all Sigstore is: it uses an identity provider to bind an identity (like an email) to a short-lived signing key.

There is also Keyoxide[1]. The goal is similar to Keybase (online identify proofs), but Keyoxide uses a decentralized approach where the identity proofs are stored on the key themselves.

[1] https://keyoxide.org