devtool reset [-a|<recipe>] will warn user that the sources/<recipe> will be left behind.  Moreover, subsequent issuance of a 'devtool add' will error out on the prior sources/ directory.

However, if the sources/ is removed, and a new 'devtool add' with a corrected URI for the recipe is given, it will use the prior "cached" downloaded version with no failure or warning.

E.g.,

$ devtool add --version 2.4.2 mbedtls https://tls.mbed.org/download/start/mbedtls-2.4.2-apache.tgz
# (downloads a landing page, not the desired tarball)

$ devtool reset -a
NOTE: Cleaning sysroot for recipe mbedtls...
NOTE: Leaving source tree /home/bjkurlex/mbedtls/dev2/workspace/sources/mbedtls as-is; if you no longer need it then please delete it manually

An additional NOTE: here to warn the user that a prior version of the downloaded file (whether valid or not) is left as well.  

Otherwise, it is is assumed (even after removing the aforementioned sources/ directory) that a new "corrected" add will work.

# issuing "corrected" URI
$ devtool add --version 2.4.2 mbedtls https://tls.mbed.org/download/mbedtls-2.4.2-apache.tgz

This will fail and isn't obvious to a new user that the prior downloaded version is negating the corrected URI even though the sources directory previously warned was removed.

Another approach is to cache the URI associated with the download and if the URI changes (but the file does not), then it should be redownloaded.