This is something that's come up (reasonably!) as a question from other package indices looking to integrate OIDC for trusted publishing.