Would that mean a package with multiple authors would have to shared the private key with each other in order to publish a new version?