Until a few weeks ago, SHA-1 collisions had never been demonstrated.
Git hashes aren't digital signatures for cryptographic authenticity.
The git tag and signing verify logic assume the sha-1 hashes for integrity.
For instance, a mere four byte CRC-32 can reasonably assure integrity in some situations, like when used on sufficiently small payload frames; yet it is not useful as a digest for certifying authenticity.
SHA-1 is suitable for integrity.