rely on digests not tags when pulling via proxy caches

We get cache misses when a tag is not yet in the cache but the digest already exists.

Can be improved by tracking digests instead.