Why would it be difficult to create a different tarball for each download? You can just have a separately compressed section with the random ID that is replaced on-the-fly.

Non trivial but a couple hours of work to implement and test probably.