Use peep to install packages

Peep wraps pip and adds cryptographic hashes to ensure that packages don't change, even though pypi allows maintainers to remove and add package versions. I feel this might possibly be a better solution than version-controlling compressed tarballs, which strikes me as the wrong approach for version-control.

We need to use a fork of peep until this gets merged:
https://github.com/erikrose/peep/pull/29