Update package-hashes to default to sha256 gpg

Please see: https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1

>Walker's estimate suggested then that a SHA-1 collision would cost $2M in 2012, $700K in 2015, $173K in 2018, and $43K in 2021. Based on these numbers, Schneier suggested that an "organized crime syndicate" would be able to forge a certificate in 2018, and that a university could do it in 2021.