This is another good point; one that's important to me, but that doesn't seem to resonate with others. Pipfile.lock ensures that the tarball I download for a g

This is another good point; one that's important to me, but that doesn't seem to resonate with others. Pipfile.lock ensures that the tarball I download for a given package release is exactly the same as the one I downloaded during development. This closes what I consider to be a fairly significant security hole.