[RFC] Let homebrew handle external resources download

@fwalch @tarruda

Close #1388
It's meaningless for maintenance as you still requires calculating both sha1 and md5 for every updates. And it's meaningless for security as an attack can still attack the MD5 users if he/she found a MD5 collision.