Custom Module Remote Fails Checksum with Drush
Answer

This isn't a good answer, but it works:

There is an undocumented drush flag --no-md5 and if you pass that to drush up it will skip the md5 check and the update will succeed.