[glenjamin]

This strikes me as something that could be done for the highest traffic packages at the backend, rather than be driven by the client at pubish-time.

[fastest963]

The article talks about this. There are hashes that are generated for the tarball so the backend can't recompress anything.