update to safer defaults

It's my understanding that verify_checksums won't work unless paranoid_checks is also enabled.  This change should make them be on for everyone unless they're intentionally disabled.

This does include people who're upgrading, but I figured that if it is our intention to force the use of these going forward, it's better to deal with the issues this might potentially cause sooner rather than later.

cc @matthewvon @jonmeredith