Something that I have experimented with for supporting multiple versions of external libraries is having a drop down list (via some CACHE variable xyz and set_property(CACHE xyz PROPERTY STRINGS a b c) in which the user choses the option suitable for him; then the CMakeLists sets the corresponding URL and hash sum, based on the user choice, that subsequently are used in the ExternalProject_Add call.
Of course this doesn’t allow for automatic fallback (the user would have to switch to another option manually), but it would enable to have a hash sum check and still an option to have multiple different sources.