Or you can't, for example because you already signed a 20 year root with SHA-1. Nor does it matter in this example and many others.