Make SHA-256/-512 optional. Note that no-sha switches off *all* SHA.