At the moment, the Gravatar provider only supports passing email address parameter. For public websites, this may not be the best approach since it would expose user's email addresses. Since Gravatar API supports requesting avatar images by md5/sha256 only, there's no need for unavatar to compute the md5 hash. The user can just pass the hash to unavatar and it should work.
For backward compatibility reasons, perhaps both email address and hash may be supported.