On your last point md5 sums seem like the right idea.

I.e., make a rule that says you must upload an md5 signature along with any file -- that way you know when a file is done -- it matches its signature.

Obviously this is a problem with less-than-skilled users.