Currently when uploading release files to Pagure it lets me upload the same file over & over again, appearing to just replace the existing file. This means that in the event someone were to compromise my pagure account, they could replace existing uploads with trojaned files. Although I also upload GPG signatures to let users verify content, the number of users who actually do such verification in reality is tiny. Thus it would be a valuable security protection if Pagure were to refuse to allow uploads to ever replace existing files. Replacing existing files should require some administrator action to first kill the file to be replaced.