[dignifiedquire]

I just finished implementing sha1collision detection, and it will be integrated into rpgp soon https://github.com/rpgp/rpgp/issues/293

This is the same algorithm used by git.

There are higher level implementations that use the dates on signatures to straight out reject sha1 material, but that gives only a limited protection.