Google have recently announced a practical SHA-1 collision.
A few years ago MD5 had similar issues and researchers even created a fake CA.
This would not be possible today - even with MD5 - because CA's must include at least 20-bits of random data in the serial number (see Mozilla requirements).
My question is a bit more general: do collision attacks matter if signed messages include random data generated by the signer?
For all the uses of hashes, I think that it's only signatures where collisions matter. And then, only when the signer is signing a message from someone untrusted. Are there other use cases where it matters? And in this use case, if the signer always includes random data in the message, does that prevent collision attacks.
BTW, I still think ditching SHA-1 is a good idea, this question is more theoretical.