I see no problem with mandating 2FA for all PyPi users, potentially offering free security keys to maintainers of Critical projects as an incentive to adopt even more secure practices.