The package name + hash is an implicit DOI. What if we added web support for it so that users could https://quiltdata.com/packages/USER/PKG?doi=SOME_HASH ?
You can take it a step further and either integrate with a DOI provider or become one yourself and integrate the registration process within your api or create command line tools.