We need to come up with a plan how to deal with obsoleted crypto in rpm.

MD5 is practically gone long since and SHA1 is on its way out too, to the point that it's not necessarily even possible to calculate these algorithms anymore (eg MD5 on FIPS mode). Yet we still carry them in various more-or-less prominent and permanent places such as the MD5 header+payload digest, database indexes (RPMDBI_SIGMD5 and RPMDBI_SHA1HEADER), MD5 aliasing for pkgid, and SHA1 aliasing for hdrid, and so on.

Besides the currently obsolete things, new things need to be built with the mindset that all crypto will become obsolete over time, and avoid putting it into new places where it only gets in our way eventually.