Custom Module Remote Fails Checksum with Drush Background

I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-documented) specifications required at https://www.drupal.org/node/542202#project%20status%20url

For those interested, the endpoint gets the project information from Bitbucket, where each core has a branch, then gets tags and parses out the tags as releases so it can get the newest one. 

There's also some unzipping and re-zipping that goes on to put the returned .tar.gz in a format that Drupal accepts.

This works alright but there's a

Problem

While the GUI for Drupal works fine to update the module from the custom remote, Drush fails. Running drush up gives me the expected prompts, recognizes the new version, downloads the file and then fails. The message:

File {filename} is corrupt (wrong md5 checksum).

The mdhash in my XML file is correct, according to the md5 utility on MacOS. (It's calculated using PHP's md5_file utility). So, whenever I download the tar manually and check the hash, it's fine. But I cannot get drush to agree with me.

Any ideas? Thanks in advance.
Answer

This isn't a good answer, but it works:

There is an undocumented drush flag --no-md5 and if you pass that to drush up it will skip the md5 check and the update will succeed.