All object transfers must include a sha1

[richo]

Instead of implementing it at the object level, even though it won't be directly testable while you're unpacking it.