Are you saying when I rebase off of upstream on my private branch does that change the sha1 of the upstream commits?

That hasn't been my experience. As far as I can tell.

Edit: OK, I did a test and I can see that it is changing the sha1 for my commits on my private branch after I rebase from upstream master. So at least the way I'm doing it I'm not changing public comit hashes.