Hacker News Reader

Not so. I use pip freeze to manage my dependencies, including all transitive dependencies, and my builds are deterministic.

How do you include checksums in your freeze to catch when the package changes on the pypi server using only pip?

I don’t. PyPI no longer allows reuploading the same release.