Adam suggested that the verify_download_integrity isn't needed here.  However, note that I'm doing a resource.DOWNLOADER.stage, not a resource.stage.  Going to the downloader is needed to extract the 'deps' tarball over the main tarball (resource.stage will extract it next-to the main tarball).

I looked through the code (of DownloadStrategy) and it doesn't do any verification, so I think I should do an explicit verification in this case.