I also only get SHA1 signed receipts. What's worse is that my recently published app update seems to fail for some users during IAP receipt validation, presumably due to my incorrect SHA256 handling. I'm not even able to reproduce this error in a sandbox environment!