Yeah, the non-malicious failure mode is extremely reasonable, and overall I think it's a good choice... minus not building in support for changing the algorithm

Yeah, the non-malicious failure mode is extremely reasonable, and overall I think it's a good choice... minus not building in support for changing the algorithm from the beginning. Checksum algorithms somewhat regularly need changing. This was completely foreseeable. The malicious failure modes... I don't know. No doubt something is possible, particularly when you account for common surrounding-system usage patterns.