As a marginal security improvement, we could add SHA256 checksums in all our requirements.txt. Most of these are developer tools, but some packages are used in test.

# <p><div class="lev1 toc-item"><a href="#Benchmark-of-the-SHA256-hash-function,-with-Python,-Cython-and-Numba" data-toc-modified-id="Benchmark-of-the-SHA256-hash ...