The ensurepip blob is a bit of a special case regarding updates, that is, I think we can be a little more flexible about them since they are getting tested and a lot of exposure external to Python releases.  Accepting a bugfix update for pip between 3.7.0b4 and 3.7.0rc1 should be OK although the closer it is to the b4 date, rather than the rc1 date, the happier I would be :)