But, in any case, that's in the cryptographic realm.
Git hashes aren't digital signatures for cryptographic authenticity.
Git hashes aren't digital signatures for cryptographic authenticity.
The git tag and signing verify logic assume the sha-1 hashes for integrity.
For instance, a mere four byte CRC-32 can reasonably assure integrity in some situations, like when used on sufficiently small payload frames; yet it is not useful as a digest for certifying authenticity.
SHA-1 is suitable for integrity.