I think I'm going to pass on this. I'd rather set the precedent of "Don't pass in a checksum when you download from Nexus, because I'll auto-do that for you." Than having to make it super-clear that its SHA256 when non-Nexus and SHA1 when Nexus.