Spec issues with consensus' new 'package' field

Hi Nick. Brought these up on irc but moving to a ticket. Our consensus' new unused packages field has some spec issues...

It isn't very future proof. It's fine for now, but I'm not sure how it could validly have new attributes in the future.
Presently it necessitates at least one DIGEST entry. Think that's probably a mistake.
'one or more non-=, non-" " characters' => That's too imprecise. For instance, it allows newlines which I'm sure wouldn't really be valid.
It would be nice if it said if a DIGESTTYPE can appear multiple times. I'd like to model this as a hash but I'm not sure if DIGESTTYPE are unique.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information