apparently PyPI supports "digital attestation" (signed binaries?) Was this package signed? https://docs.pypi.org/trusted-publishers/