Currently, the local database contains the desc file (mostly/the same as in the synced databases) and a list of files + mtree of a given package. It'd be nice to also include hashes of each file provided by those packages. This would enable users to verify if the files on disk are consistent with the original package content and to find all changes compared to a fresh system with the same installed package list. (It's not a security improvement though, as any potentially malicious program that could overwrite root-owned package files can also overwrite hashes in the local database.)