Similar to #55. Allowing the _set_ property in _psc-package.json_ to be a commit hash would be secure against sneaky set modifications.