Don't validate md5 checksum if not set

But log a debug message instead.