Comment by woodruffw

Yes, that would be a better setup and it’s exactly what PyPI is moving to[1]. This closes a gap in the legacy upload API, which evolved over time instead of being designed to avoid these kinds of problems.

[1]: https://peps.python.org/pep-0694/