verification is sort of pointless, because:
The Cargo.toml file is parsed and reformatted by the packaging tool to normalize its contents.
Thus, the Cargo.toml file of the downloaded version never matches the Cargo.toml file that's actually used.
Unfortunately, there doesn't seem to be an easy way to check the equivalence of two Cargo.toml files,
except for recursively and deeply parsing through and comparing all the possibile keys and values of
the abstract key/value tree. This is a much bigger project than I'm prepared to figure out today.
As a hack, we compare to the Cargo.toml.orig file. Which is...kind of OK, but really, this opens us
up to attacks where someone just has to replace a version on a package or even just swap out an
entire package for a malicious one by just using package name re-assignment which is a thing that
the format supports. In other words, all this checking is kind of pointless because it's super-easy
to swap out key crates for whole other crates and have it go undetected.
