The hashlib doc starts with "Warning: Some algorithms have known hash collision weaknesses, see the FAQ at the end" (the "FAQ at the end" is a link to a Wikipedia article). The sentence "Included are the FIPS secure hash algorithms SHA1, SHA224, SHA256, SHA384, and SHA512 (defined in FIPS 180-2) as well as RSA’s MD5 algorithm" also conveys the idea that MD5 is not part of the "secure" bunch. The only addition I can think of would be to replace md5 with sha1 in the small example snippet at the beginning.