So, even with figuring out the SHA1 issue (and getting past it) - the best you can do is swap around some encrypted data for other encrypted data.
The PUP file itself is a handful of tar files and a few xml files with a HMAC-SHA1 signature in the header - this prevents tampering with the tar/xml files.