So if the metadata specifies an algorithm that hashlib doesn't know about, we're just going to try sha256? Why wouldn't that just be an error? It seems that reporting the algorithm miss would be more valuable than just calling this a "checksum mismatch".