PyPI's user docs[1] have some more details, as does the underlying PEP[2].
[1]: https://docs.pypi.org/attestations/
[2]: https://peps.python.org/pep-0740/