The background of my question is described in Managed package upgrade fails as Named Credential seems to have modified.
The upgrade of a managed packaged failed with a modification error on a packaged Named Credential. But there way no change between installed and updated version.
We then found out that the customer in his org changed the Certificate field which was empty in the package to a value.
Is there a way to lock / prevent such changes? Or is this how it's intended to be? Maybe Salesforce should just provide better error displays.