Fix python#13

Author: trishankatdatadog

pep-0458.txt

@@ -361,23 +361,25 @@ __ https://github.com/theupdateframework/tuf/blob/v0.11.1/docs/TUTORIAL.md#how-t
 How to Establish Initial Trust in the PyPI Root Keys
 ----------------------------------------------------
 
-Package managers like pip need to ship a file called "root.json" with the
+Package managers like pip MUST ship the *root* metadata file with the
 installation files that users initially download. This includes information
-about the keys trusted for certain roles, as well as the root keys themselves.
-Any new version of "root.json" that clients may download are verified against
-the root keys that client's initially trust. If a root key is compromised, but
-a threshold of keys are still secured, the PyPI administrator MUST push a new
-release that revokes trust in the compromised keys. If a threshold of root keys
-are compromised, then "root.json" should be updated out-of-band, however the
-threshold should be chosen so that this is extremely unlikely. The TUF client
-library does not require manual intervention if root keys are revoked or added:
-the update process handles the cases where "root.json" has changed.
-
-To bundle the software, "root.json" MUST be included in the version of pip
-shipped with CPython (via ensurepip). The TUF client library then loads the
-root metadata and downloads the rest of the roles, including updating
-"root.json" if it has changed.  An `outline of the update process`__ is
-available.
+about the keys trusted for all top-level roles (including the root keys themselves).
+Any new version of *root* metadata that package managers may download are verified
+against the root keys that the package managers initially trust. If a root key is
+compromised, but a threshold of keys are still secured, the PyPI administrator MUST
+push new *root* metadata that revokes trust in the compromised keys. If a threshold
+of root keys are compromised, then the *root* metadata MUST be updated out-of-band.
+(However, the threshold of root keys should be chosen so that this event is extremely
+unlikely.) Package managers do not necessarily need to be updated immediately if root
+keys are revoked or added between new releases of the package manager: the update process
+automatically handles the cases where a threshold of previous *root* keys sign for new
+*root* keys (assuming no backwards-incompatibility in the TUF specification used).
+
+Thus, to repeat, the latest good copy of *root* metadata MUST be included
+in any new version of pip shipped with CPython (via ensurepip). The TUF client library
+inside the package manager then loads the *root* metadata and downloads the rest of
+the roles, including updating the *root* metadata if it has changed. 
+An `outline of the update process`__ is available.
 
 __ https://github.com/theupdateframework/specification/blob/master/tuf-spec.md#5-detailed-workflows.