Require the publish-branch owner to fast-forward a clean checkout to the exact independently verified revision.