Sha checksum

This is my rebased version of #33 

Plus my suggestion that it warn in the case that `Digest::SHA` is not available.  I am also okay with other possible approaches:

 1. Dying if sha sums are specified but `Digest::SHA` is not available
 2. Making `Digest::SHA` a prereq

As `Digest::SHA` is in the core as of Perl 5.10 it is only an issue for really old Perls anyway.