I'm not sure what issue this is trying to solve either. It looks like it could be used to vendor dependencies but also publish them to an index? I don't understand the purpose of including a hash in the package name.
This project is specifically about publishing test cases for package managers -- it's not a package manager or a registry itself. We use it in uv [1] to test that our resolver is spec compliant. pip also explored using it for the same reason.