[thewataccount]

I'm confused as to why package signing isn't standard for all package managers.

Didn't Pypi just remove signing too?

[bravetraveler]

PyPi did indeed, but it's a fairly interesting case. It was removed because the implementation was ineffective

More information on that here: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI...

There was a lot of talk about why this didn't go the other way; keeping signing, but making the practice meaningful. I forget the details about that.