Hacker News Reader

Signing git commits is broken anyway as you are basically signing the commit hash (which is a sha1, whose collision resistance is broken).

I recall hearing github is planning on Sha-256 some time

They're more likely to employ counter-cryptanalysis [1] in the meantime.