My theory / suggestion:
Why not just have it to where we can make our own custom hats for the price of $0.00
The clients would send the current hat model that they are wearing to the server. The server would keep a cache of hats and distribute it to all the clients to where they store it in memory. If there were multiple hats with the same name, just verify with sha1?
If someone would stretch it all the way into oblivion, just have the clients limit how far the geometry can go.
Then again, I could be totally wrong on this one.