merkle: change to use sha256