To make pip slightly more efficient, I think the idea discussed in " specifying static metadata that can be trusted" is less disruptive for the users and do not require a change in name:
- if the name & version are marked as reliable metadata, as will be the case with “modern” builder, trust them
- otherwise, build the metadata to check; users might complain that it is slow (like it already is) but we’ll be able to suggest them to switch to a “modern” builder.
But yes, you’ll still need to download the sdist to check it (which would not be needed with the name change), but I find this less impacting than a name change.