Switch from SHA-1 checksums to more general UIDs.

The UID can contain anything, our standard will be to use something
like 'doi:<doi>', or 'sha:SHASUM' (if there's no DOI).  This closes
issue #48.