You are right, SHA2 is fine still, mostly. But... Combining with HMAC isn’t exactly a seal of approval. HMAC with MD5 is still considered secure because even i

You are right, SHA2 is fine still, mostly. But... Combining with HMAC isn’t exactly a seal of approval. HMAC with MD5 is still considered secure because even if you made a hash collision you didn’t have the key. And yes, SHA3 would be overkill. Most people don’t understand the mechanics of hashing let alone the new keying that SHA3 brings.