Currently, the NAR hash is mandatory. This would mean requiring just one of ca and hash. Having both is still fine.

I figure as long as we have one way to verify a path's contents, we should be fine. Conferred with @LnL7, who thought not doing this was just a holdover from before the ca field existed.

This would be good to give other NAR alternatives slightly more equal footing, which generally sounds nice, but which I'd specifically be interested in because of the git object work for IPFS. It's by no means a blocker though, as we can always just continue to compute the nar has in addition to anything else.