Well as of now, we also enforce A-Za-z0-9\- `name` keys so that's good. Otherwise we wouldn't be able to `npm install` deps with an invalid name in our package.json.

@canuckistani brought up a good point -- people aren't going to be submitting ADDONS to npm -- just third party modules that will be consumed by addons. I think having an ID solely for AMO will be okay.