That is date after which purchase of _new_ software with SHA-1 will be forbidden, which seems late given that it takes only two months on GPU to find signature collision with a chosen prefix.

Sounds like the deprecation schedule is too slow and unsafe.