Hi,

 this goes for dpkg-dev as well.

 I want to suggest that dpkg shall support md5sum's of control.tar.gz
 and data.tar.gz inside the .deb itself, for instance in debian-binary
 or a separate file.

 This would help to recognize defective .debs prior to installation.
 I had to face such a case recently where a defective libc6 package
 broke my whole system.

 The md5sum in Packages is not sufficient, cause it need not be available
 and is not checked for installation by dpkg -i.

  Ulf