Right now, zef takes whatever is in the URL pointed to by source-url, as far as I can tell. Distributions are not forced to release via tags, or to announce those releases via META.list. Besides, we don't check for changes in META6.json.
There should be a way of announcing or saying which version is the official. Just adding a version number that should correspond to a tag (and to the version in META6.json) should be enough. Besides, now "version squatting" is possible: just release a new distribution with a later version, and the ecosystem will get yours.
I am kind of aiming at CPANTS, but not only. A sweep and test of all distros would be nice, but as far as I can tell, this is what zef does; that's good and well, but it's not within the ecosystem, or available to the general public (or to other possible dependencies management tools)