To speed this up PEX would need to relax a bit and trust certain VCS urls, like commit ids for cryptographic VCS (git commit IDs but not svn, for example) but not tags or branches.