mention pypi hash instability and the peep project