Currently there's no validation of the tag with the version in the composer.json. This difference, besides confusing, would cause the versions compiled/packaged be different from what is shown on the pickleweb site or in phpinfo().
This interfere with the pickle issue FriendsOfPHP/pickle#111 , so pickleweb could be using the pickle itself for the triple validation - tag, composer.json and the version in the header file (or any other way for different engines).