2 publicly visible posts • joined 26 Oct 2017
I'm afraid you are mistaken. Git still only supports SHA1, as do DNSSEC NSEC3 records.
Public key cryptosystems don't sign data directly - they sign cryptographic hashes. A compromise in SHA1 can potentially make the same signature valid for two different plaintexts if the signature was generated using SHA1.