That was my first thought, too. Then I stopped as the PackageMetadata is really a "stupid" information container and the validation if the container is ok, should be done somewhere else.

This should be adressed somehow ;)