You shouldn't trust Trusted Publishing

PyPI's Trusted Publishing is an OIDC-based machine-to-machine authentication scheme that lets CI/CD workflows publish packages without long-lived credentials. A common misconception is that a package using Trusted Publishing is somehow safer or more trustworthy for end users — it is not. Trusted Publishing only authenticates the upload; it says nothing about package quality, safety, or legitimacy. Anyone can use a Trusted Publisher to upload malware just as easily as a legitimate package. PyPI deliberately avoids surfacing Trusted Publishing status as a trust signal in its UI, and the Trusted Publishing status is buried in file metadata with no normative trust implication. Similarly, attestations (also OIDC-based) do not imply end-user trust until you separately establish trust in the signing identity.