Clearly makes sense and would be an interesting security feature.

However, this would require that every package creator to update their package unless you find a way to extract this information automatically from the code (which might be possible !)

Good article !