Hacker News Reader

This strikes me as something that could be done for the highest traffic packages at the backend, rather than be driven by the client at pubish-time.

The article talks about this. There are hashes that are generated for the tarball so the backend can't recompress anything.