Comment by shanipribadi

hashes would also need to be specified for all dependencies (transitives) in case they were needed,

and all dependencies need to be pinned to specific versions as well. hence this would only work when users are making use of venvs, instead of user install / site install setup.