In my opinion, there are some problems with this, such as:
- The cryptographic hash is not included. (They do mention security, a hash and/or public keys would be helpful for security. It would also be helpful for identification if names are reused for unrelated reasons.)
- There is not a distinction between interfaces and implementations (which in some cases you might care about, although not always).
- They do not mention examples of what qualifiers are possible for some package types.
- The cryptographic hash is not included. (They do mention security, a hash and/or public keys would be helpful for security. It would also be helpful for identification if names are reused for unrelated reasons.)
- There is not a distinction between interfaces and implementations (which in some cases you might care about, although not always).
- They do not mention examples of what qualifiers are possible for some package types.