Facebook Research has now funded implementation of
cryptographic signing of packages on PyPI. Per
https://github.com/pypa/warehouse/issues/5247#issuecomment-535278176
this means that PEP 458 now moves out of Deferred
status and into Draft status.
Since the PEP was created, the BDFL-Delegate for
PyPI-related PEPs has shifted, and Donald Stufft
is now the Delegate.
PEP 458 now focuses on content security (rather than the current
transport-only security) between PyPI and end users.
PEP 480 builds on PEP 458 to also provide end-to-end security
that can fully handle a compromise of PyPI.