For example, PGP v4 Key IDs are a subset of PGP v4 Key Fingerprints. PGP v4 Key Fingerprints are SHA1 hashes of some protocol information and the key material (for more detailed information see RFC4880 section 12.2). So, a proper collision, with other properly constructed packets, could yield two seemingly "identical" keys. Therefor, they may be able to produce a fake PGP key that you think belongs to a person you trust and want to communicate privately with but actually does not.
Hash function collisions can be similarly exploited with digital certificate protocols (like SSL web certs). So, a crime syndicate may be able (depending upon how badly certain hash functions are broken) to produce a fake SSL certificate for your bank's website that your browser thinks in valid. Or even worse, they may be able to produce a fake root CA singing certificate that your browser thinks is valid.
It's more complex than just "can compute hash collisions = fake certs" because there's a very limited amount of information hashed in both certs and PGP keys. The more data that is hashed the easier it is to find a collision. With PGP much of the data has to be very specific like version and algorithm designation flags and valid cryptographic values for the algorithm designated. It's safe to say "very limited flexible data = very difficult to find a collision".
Therefor, these calculations are interesting and do suggest that everyone should move away from using SHA1. But, the calculations to determine when a criminal or an anti-sec use case would be possible are much more complex and involve many more variables.