DKIM: disallow default acceptance of sha1 for verify