And a problem with Python packaging is that it's far too flexible.
For a pure Python package, IMO every single file in the wheel should be bit-for-bit identical to a file in the source tree (with the possible exception of a manifest listing the files). If this were actually a guarantee, even just for a category of package that opted in, then:
a) The build "tool" could be replaced with a build file selector, which would often be completely trivial and could have default behavior that worked for almost every pure python package right in pyproject.toml and
b) Instead of the giant mess of sigstore and attestation and weird trusted builds we have today, we would have a straightforward proof that a wheel actually matched a git commit irrespective of who built it. In fact, the proof could be embedded in the wheel! And the proof could be verified without executing any package-controlled code.