There are two options. Either you "lock" the hash, making it illegal to insert, or even look up into the hash with keys you didn't define as legal keys. Or you forbid the use of "magical constants". For decades, we've been saying that code like:

    $var += 42;
[download]

should be avoided - 42 should be put in a meaningful variable (or constant if your language supports that). There's no reason to not apply that logic to string literals as well. If all your hash keys are lexical variables (and you use strict), you get the same benefits that you get if you avoid using package variables. String literals as hash keys are worse than package variables - -w will catch many mistyped package variables, unlike mistyped hash keys.