Squeak has DSA in the image. I dunno why DSA was chosen over MD5 -- if the uses of DSA can transfer over, still, then it would be nice to switch.
There was no choice made - DSA/SHA was in the image long before I wrote the MD5 stuff. The former were written by SqC people apparently to support signing of code for security reasons. I did the latter because it was a straightforward extension of the existing SHA code (which is why it is so similar), and because exobox potentially needed it for various miscellaneous Internet protocols. Plus it's a handy thing to have around.
One reason I believe it has not made it into the image is that a request was made by SqC a few months back to try and refactor SHA and MD5 functionality to take advantage of their similarities, but neither I nor anyone else found the time to do so. I agree that it should probably be part of the image.
I also think that we should choose one of the extant XML parsers as well and have a known base from which to develop XML-based stuff (SOAP/XML-RPC, RSS, whatever). I will not be suicidal if the choice is not the one I wrote, though I would be willing to expend the necessary effort to address any weaknesses and/or extend it to fit the needs of the Squeak community.