I think adding a yanked flag is a good approach when it comes to PyPI. It is how packages are "deleted" from that index anyway, and package managers do have to deal with that on a regular basis. I'm happy to give that a try on our end. I think purely for the "let's not show the users packages newer than x days", newer packages could also be entirely omitted. This should not break anything if it was applied this way: Stop showing packages newer than the moment the policy is enabled. Wait x amount of days. Start showing packages uploaded x days after the moment the policy was enabled. Essentially ProGet would delay everything it pulls in from PyPI. Maybe that could be an option on the connector. This doesn't work for "noncompliance" in general, and I don't know how well it translates to other package indices.

@dean-houston, thanks for fixing that bug and detailed response to dependencies.