RT @nelson: This came up at breakfast: Python does not verify signatures on packages installed from PyPI via pip. We're all just sort of ho…