How come you don’t just send the md5s to delete rather than the shell script?

That would definitely work too.

What I like about my process is that there is only one source script (the python one) to keep around.

I guess it's a more flexible design that allows to change the criteria for deletions in the future. You still need to calculate md5s on the phone either way.