Pip already automatically checks for hashes, but we don't generate them into the lockfile. Need to check whether we can do that