Allow pinning the content of remote sources with hashes

This protects us against the use of mutable URL references, and also makes things more Nix friendly.

We might want to make it possible to require this.