blargh. looks like pypi might have broken gpg signing somehow.