use sha instead of md5 to verify mfsbsd download

it's more secure and also crossplatform