upgrade to sha256 and oaep, extra paranoid