The PyPI seems to be having a hard time recently. There are a lot of malicious packages uploaded (1, 2). The signing with GPG seems to be more cosmetic than security relevant (1). PyPI agrees and dropped PGP signatures for new uploads after an audit found that only 36% of the signing keys could be meaningfully verified. Still, the PSF is also doing some things really well, judging by this blog article.
The United States Department of Justice subpoenaed the PSF and requested information on five PyPI users. The subpoenas were not associated with a non-disclosure order. The PSF published the post as a matter of transparency. In the article they describe what information PyPI stores and what was forwarded. Also, the article implies that the PSF received more subpoenas than are explicitly discussed in the article. The Register points out that PyPI could not hand over download IP logs or billing data because it never kept them, which remains the most reliable form of data protection.