PyPI now supports digital attestations

The root point of this seems to be PyPI does not have the resources to manage user identity, and wants to outsource that component to Github, et al. That sounds fairly reasonable. But why deprecate GPG signatures? The problem with GPG signatures as I understand it is it's difficult to find the associated public key. That's fair. Why not host and allow users to add their public keys to their accounts? Wouldn't that solve the problem?

GPG is an ancient bit of tech with numerous problems:

* An extremely complex, byzantine packet format with security problems of its own.

* Decades of backwards compatibility, which also harms security.

* Extreme unfriendliness towards automation.

* Way too many features.

* Encouragement of bad security practices like extremely long lived keys.

* Moribund and flawed ecosystem.

Lots of cryptographers agree that PGP has outlived its usefulness and it's time to put it out of its misery.

And really there's little need for GPG when package signing can be done more reliably and with less work without it.

I was a fan of PGP since the early days, but I agree that at this point it's best to abandon it.