Cosign was fine when it was the only game in town. But the Go-centric tooling and opaque TUF roots became a pain point. We're a Python shop. Needing a separate Go toolchain just to sign a Python package felt like security theater.

Switched to sigstore-python. The wins:
* Native integration. Sign and verify from within our existing toolchain and CI.
* No more external process wrangling.
* Fulcio certs are the same, but the UX is cleaner for our use case.
* Keyless flow is identical, which is what we use for CI anyway.

It doesn't solve the real problem—you still have to trust the root. But at least the tooling friction is gone. If you're already in the sigstore ecosystem but not a Go shop, it's a logical move.