now that pypi went the wrong route and deprecates gpg sigs, it would be nice for the forge to support it