...have my web page generate an MD5 checksum on the uploaded file and allow them to download a patched version...

Heh, this sounds suspiciously like the "my MP3.com" thing that got nailed so hard a while back. Anyone remeber that one?