Replace MD5 commands with SHA2 equivalents

A more secure hashing algorithm makes it less feasible to serve up a
modified tarball that matches the same checksum.

See the discussion in #548
Re-introduce legacy MD5 checksum verification based on checksum length

This is so any 3rd-party definitions continue to work even if they have
MD5 checksums embedded.
Replace all MD5 checksums with SHA2 checksums
Merge remote-tracking branch 'origin' into shasum
Switch remaining MD5 checksums to SHA2
Update Readme for MD5 -> SHA2 checksum change
Merge branch 'shasum'

Fixes #548, closes #551