When in FIPS mode, use SHA1 to digest the key, rather than MD5, as MD5

isn't a FIPS-approved algorithm.

Note: this means the user needs to keep track of this, and we need to
add support for that...