My comment was not related to a security, but rather to URL encoding. If the licenseKey contained ampersand or other special characters than it would messed up the URL query parameters. 

MD5 is safe from this perspective, but I don't think VersionCheck should rely on a particular format of a license key (unless there is a test)