Recommend reading related blog post https://bernat.tech/posts/securing-python-supply-chain