Not sure this is the right solution for 2 reasons:

First, I'm uncomfortable with making a package creator's VCS provider part of the language's module infrastructure.

Second, not all files under version control necessarily belong in a tarball, and not all files in a tarball necessarily need to be under version control.

However, the point that there should be an easy way to track changes in your dependencies is well taken. One possible approach would be that publishing a packge boils down to importing the files that normally would go in your tarball into a community-controlled VCS.