Come on. On what planet are you living? What other signing options are the best practices?
Hint: "best" doesn't mean "ideal", it simply means "better than anything else".
Hint: "best" doesn't mean "ideal", it simply means "better than anything else".
GPG's Web of Trust cannot answer the question of who is trusted to sign for a particular package on PyPI. At best it can tell you that a key that is signed by someone whose key you've signed. That is not a meaningful security control. Practically nobody is signing GPG keys thinking "would I trust this person to sign for every package I might ever want to download" and they are instead at most trying to verify the identify on the key matches.
It's existence creates a bunch of people who insist in trying to take up the oxygen in the room anytime serious security design is trying to happen to try and shoehorn gpg in places where it has no business being.
"Best practice" is cargo culting.
Everyone's got different requirements and constraints. If one thing is apparent, it's that pypi doesn't have in a requirement that packages are signed, because no-one (publishers and clients) is currently using them properly. And yet, python (and pypi) is alive and popular.
If that's the case, the "best" package signature scheme is none at all.