Can someone confirm for me using a non robot answer that to have package attestations on pypi, your entire build process and upload must entirely take place using a commercial CI provider such as GitHub actions. It will never be possible to do the actual build on your local machine anymore and twine is effectively a thing of the past if you want your packages to be trusted. This is what I'm being told