We had this conversation when it was md5 vs sha2 and concluded sha2 was good enough. What changed?