There is such a thing as a tested system (ie two or more Independantly built packages that have been demonstrated to work together). This is the concrete - I have built these things and tested them - now take them both as they are and put them live. I now dislikes the idea that I will build packages (with pip literally from source) on production machines.
No I don't quite get this - dependencies are just that - we depend on the code they provide to run. A library author cares as much as a sysadmin that they avoid a version of dependency that breaks the package.
A better spec might be
Requests=1.1,1.2,1.4 #oops 1.3 broke our tests
None of this Precludes the useful ability to specify which location to retrieve which package from, but these are build instructions, not deployment instructions.