I'm back to creating the missing pypi profile page.
General idea:
pipx install pypi-profile
pipx inject pypi-profile matthewdeanmartin
pypi-profile serve
Then the page would spin up in a website, and allow searching and displaying installed pypi profiles and some cryptographic signature thing so you the app can verify signatures at "profile" sites. (like rel=me with signatures) This would extend id beyond "this build server* built this package"
`*` probably hijacked due to gh actions vulns