Just to sum up yesterday:
1. as soon as you put one file on pypi from CI with attestations, you now have to use CI releases / attestations for *all files, forever*, or you will get large red warnings on your package (and they dont send you emails either).
2. if you dont use attestations at all […]
fosstodon.org
Original post on fosstodon.org