Why is this a bad spot to create a MessageDigest?  We want to compute the SHA-1 hash of the content array, the standard way we do that in JGit is to create a MessageDigest though this factory function, use it, and discard.  We usually don't pool MessageDigests because they tend to be fairly inexpensive.