The git system gave me an idea for this recently too. Basically, we could have something like mod signing. A mod would simply be released with a list of files it contains, and their signatures. The compilation of these signatures would also become one signature, the mod's own signature. Therefore, a particular release of a mod would have one unique number. So, FSO could scan all mod folders for this signature set, and immediately tell if files were tampered with, at least without re-adjusting all relevant signatures in the file. You also wouldn't have to worry so much about folder names for mod installs, you'd simply need to find the folder with the right signature. FSO would be able to tell if any files it has loaded are not part of a signed set. If it believes the files are valid, the next step to joining a multiplayer match would be to make sure the signatures themselves match what was on the host. You'd only need to send one signature at first to cut down on handshakes, and if it doesn't match up, the client could ask the host for the full set of signatures and what mods they were tied to. Then the client could try to see if those signatures were available, in what folders, and reboot with the right mod options loaded.