Looking at the way packages are updated with tazpkg we need to change it to a md5sum check method. The idea is that the cache can should only install packages that match md5sum in $LOCALSTATE/packages.md5 file. This could also allow for updating packages in $CACHE_DIR without updating/installing to system yet.
It would also be nice to check md5sum when using tazpkg get-install to make sure your installing the latest package.