Git is DEAD

DEAD
https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

>>7

but IIRC git doesn't use SHA1 for security

This is false, the -S command signs the SHA-1 of the commit, not to mention that if a collision happens it can mess your repo or even insert malicious code without warning.