the default 'sha256' should be a global constant instead of a literal.
we should also do some sort of algorithm validation here to make sure they pass in a hash algorithm that is supported