Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)?
The only danger is that the application now holds a fingerprint of your key. Thus enables the possibility to do some attacks, like bruteforce, and something to check against. And so it really comes down to the "same old question" as of how to keep your password-storage safe. If the key-file is a large one and somewhat random, then bruteforce is most certainly out of the feasible picture, however if it's not or the key-file is a common file or just a text-file containing a common word, the attack methods doesn't differ that much from what every webapp developer is trying to secure.