If pypi won't let you add signatures, can you generate one of your own (for internal use) using a repository manager like jfrog, operating as a pypi proxy?
It seems the focus now is more to keep the secrets on github and authenticate with those.
https://discuss.python.org/t/2fa-usability-on-pypi-and-with-...
It reminds me a bit of what the journalism world did by becoming so reliant on Twitter for sourcing and communication, but in our case I think it's deeper and worse. We've hard coded GitHub into countless systems. I'd venture to say that most CI systems, package managers, build farms, etc. would break.
And at work my team uses a mirror on LAN. The other teams on the other hand…
I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for.
I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.
Signatures are checked if present, at least.
Also packages that stop working because python removes stdlib modules that they use, tend to get found and patched in distributions. In pypi if they are abandoned, they will be unusable for all eternity.