Per comments in PR#1745:

While the use of md5 in _get_arch_mmd_output and _get_output is indeed not for security, it would still be nice to get rid of it. Koji also supports checksum_type=sha256 now. This would be a good follow-up, though we need to be careful about possible compatibility issues for module consumers.