[cpburns2009]

PyPI (which is what Pip uses) at the very least does not require authors to sign their packages. I can't say whether it supports signing though.