Agree that the digest has to be checked on every tools/list refresh and not only at install. One thing I would add: a pin only helps if the fail-closed path is actually tested, so I would make the host log the old and new digest side by side when it refuses a call. Whoever gets paged then sees what changed without digging. Did Pillar say if Deadbugz changed only the descriptions, or the input schemas as well?