Document that we should also offer sha256 checksums for packages

SHA1 is rapidly being deprecated for most applications, and Django should offer SHA256 signatures.