Talking to @morlovich we should only use an etag if the hash matches. The reason we can always have an etag of '0' is that we're trusting the hash to serve the same function.  When the hash mismatches and we server with cc:private that assumption is violated.