Maven Central

The one interesting thing that Maven central does in this respect is when you file that Jura ticket, you are claiming the ability to publish under a given group ID. So for me, or dot web jars or combat James Ward, and they actually do validate that that you own that reversed domain. But yeah, hard. You know, somebody's got to go review every Jura ticket. And so that's definitely one of the downsides of the model of Maven Central is that what you sign with could be any key. They don't care. You just have to sign it, which is unfortunate.