I'm hoping public/private dependencies RFC will help some. One idea we have for a follow up is to declare that you should get the version req for one crate from another.