Maybe "outsource" the checksums by turning the package into a "bagit" package

[xrotwang]

BagIt is a well-specified package format with good tool support (e.g. https://pypi.org/project/bagit/). It looks like the Poseidon package structure could be turned into a proper BagIt structure by adding (the trivial) bagit.txt and manifest-md5.txt and moving the data files into a data directory. Doing this would allow you to refer the fixity checking to bagit and thus making the Poseidon spec more lightweight.