Lighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.
Then they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"
How have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.
There's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.
Helping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.
This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
