Updates to PEP 470

I'd add another SHOULD here, suggesting that tools provide the ability to disable the default repository. If folks want *selective* access to PyPI, then we can recommend devpi, with its PyPI whitelisting feature.