In reply to Otto.

I know you don't care much about European notions of privacy, but yes, this is a valid concern as we promise never to disclose email addresses for comments and an MD5 hash does just that. (Comments can exist for a long time, so you might not even remember using a specific address.)

Furthermore, you do not get a choice, even if you don't use Gravatar, the MD5 hash is published by the current WordPress Core implementation. Caching or proxying (and using a better hash function for the public-facing site) can mitigate that issue, but Core currently does neither.