Adding a content integrity hash in the lockfile seems like a more flexible solution.