Probably should use something stronger than `phash2`, such as MD5 or SHA1. We really need to change K/V trees to not use `phash2` as well for 2.0, but that's a bit more complicated since we already shipped with `phash2`. Probably good idea to avoid shipping with a weak hash in the first place here in metadata land.