FWIW, I also maintain a "critical" package, and I'm happy that the index is requiring 2FA for it.