Or you can't, for example because you already signed a 20 year root with SHA-1. Nor does it matter in this example and many others.

Still depends. Using SHA-256 for password storage is bad. Argon2 would be a much safer bet. Or maybe scrypt or yescrypt.

And blindly use a suggestion from hn without understanding the tradeoffs.