Adding an extension point for the validation of artifacts. This is definitely a provisional API. My first use case is making sure the SHA1 of the remote version matches the SHA1 of the local version. Trying to be a little more proactive in validating and allowing different sources provided the SHA1 is the same.