Issues around method option

The method option has :required => true, :default => 'SHA1'. Since there is a default the user is _not_ required to set it, and it is confusing that the documentation appears to say that they are.

Is it time to move the default from SHA1 to SHA256?

MD5 was broken 20 years ago, and SHA1 is clearly broken in 2020. Should these be deprecated and support removed in a future version?