For most uses, this kind of security doesn't really matter, since callback queries generally don't handle things that need to be secured, and in some cases the hash will be annoying for the developer more than anything since it uses up some of the 64 bytes that callback_data is allowed to consist of (in fact it seems that due to how botogram handles callback_data you're limited to only 32 bytes).

Therefore if we do decide to implement this (PRs are always welcome!), it should be 100% optional.

A similar subject was previously discussed by the developers. In general, what should be sent over the callback_data should be a secure key (UUID is a good example) which, similarly to a cookie, when received by the bot will be mapped to actual data.

It would be nice to provide the user with tools to do this simply

https://github.com/python-telegram-bot/python-telegram-bot/projects/6

This can be safely closed, as this is not an issue anymore

While callback_data is in fact checked by TG, they don't want us to rely on it (made the effort to ask @botsupport about that). Also #1844 is on the roadmap anyway, which will close this ;)