Current extensions will work just fine. The validation only happens on names in package.json, because I assumed that the name of the zip file must be a legal filename since it's already a file on disk.

When the CommonJS package spec was created, people argued that since the name would be used on disk and since different filesystems had different rules they would just be conservative about the naming. (I believe there may also have been the case sensitive vs. case insensitive filesystems argument, which is why the names are all lower case.)

I think the rationale is reasonable, especially since the "name" in our context is just an identifier that does not need to appear on screen.