Don't use `sha256` unless it's listed as that on their website.