src/backend/libpq/auth.c:847: * has. If it's an MD5 hash, we must do MD5 authentication, and if it's a src/backend/libpq/auth.c:848: * SCRAM secret, we must do SCRAM authentication.
Not sure whether you were just listing examples and you weren't suggesting this should be changed, but surely "SCRAM" is pronounced "scram" and is thus "a SCRAM"?