SwiftPM needs a way to ignore or reset its recorded commit for a package

That's right, it is similar to the proposed --disable-security-checks, I guess, not the other alternatives.