The replies explaining how to use pypi are probably going to be helpful for someone but in my case and maybe this is something others haven't thought about, is Pypi dropped support for PGP signing. Pypi strips away and excludes any signing if someone tries to sign their package. Pypi uses a different way to verify based on Open ID Connect (OIDC). I think it's less secure and I don't like it. They made it that way because most people think it's complicated to use GPG. It's unfortunate they don't want to support both methods of verification.