It seems like it using md5 at any point along the way presents a problem because if it is on a FIPS system md5 isn't allowed. I thought one of the major reasons for this change was so that puppet worked better on FIPS compliant systems.