Might anyone be able to shed some light on what this means for Magento 2 sites using Authorize? I've had weirdly little success finding any discussion on this.
I haven't been able to find much more discussion on it, but others have realized the issue as well: https://github.com/magento/community-features/issues/127
The end of life for MD5 Hash will be done in two phases:
Phase 1 - Remove ability to configured/update MD5 Hash setting in the Merchant Interface. This feature will be removed in the coming weeks by end of January 2019/early February 2019. This change has no impact to the API response, that will be done in Phase 2.
Phase 2 - Stop sending the MD5 Hash data element in the API response. The date for this change will be announced at a later time but is expected in the next 2-3 months.
For more details check this https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement
MD5 is getting disabled completely and it means Magento 2 will most likely need an upgrade to remain compatible. Authorize.net has stated that the existing hashes will not be immediately killed when setting the MD5 is removed.