If they use a well-maintained standard library which uses a modern cryptographic hashing function, then I think they earn that trust.

There is no real disadvantage to saying which one and a lot of trust to regain.