I generally think this is a useful idea. It enables the “pip freeze with hashes” use case that is sometimes requested on the pip tracker.
I have not had time to review in depth, but one thing I would like to suggest is to reference the direct URL data structure instead of re-specifying it in the PEP with possible subtle differences that would make its generation and consumption harder for implementers. To enable that, I had submitted a PR to packaging.python.org to have the data structure specification in a standalone document so it is easier to reference independently of the direct_url.json / PEP 610 context.