Fedora is in the process of making everyone use NSS. Details can be found here: https://bugzilla.redhat.com/show_bug.cgi?id=333741
I don't think fontconfig uses any crypto functions...
I was under the impression that fontconfig uses sha1. Clearly I'm wrong and it just has a copy of MD5 which is negligible.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.