Checksum tarballs with sha-2
Tarball metadata should be maps
Even safer safe_term