[PITCH] Support for binary dependencies

If we do, it would make whitelisting more complicated since you'd need to tie that relative path to the package identity somehow.