A more secure hashing algorithm makes it less feasible to serve up a modified tarball that matches the same checksum. See the discussion in #548
