See https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/, https://docs.pypi.org/trusted-publishers/using-a-publisher/.

To support trusted publishers, add this to the pypa/gh-action-pypi-publish step:

permissions:
  id-token: write

Perhaps a boolean flag to turn this on or off?