Post #1860150

@pradyunsg @davidism Recently we even got one that was like "hey, if the package index was compromised in this *obscure* way, because pip doesn't validate metadata consistency in this one specific area, pip now has a critical security vulnerability 💥" like... c'mon, we'd have much BIGGER problems beyond pip if PyPI was compromised/insecure