i am not saying git is insecure - i am saying someone needs to do exactly the analysis you are sketching. you can wave your hands and say that this is not a problem, but it's been 6 years since sha-1 was broken and that's an awfully long time.
also, i find it absolutely typical of the place that HN has become that my original post asking a reasonable, informed question with reference is voted down. you're a bunch of mindless fucking morons.