use sha256 by default

Because it's what's recommended now.