It was recently revealed that the SHA-1 hash algorithm has been broken
Several effected areas are detailed such as for example git and document signing. One thing that isn't mentioned is application integrity verification.
One application using SHA-1 for this is GnuPG. Even though they recommend to use an older version of gnupg to verify, the SHA-1 hash is used in case of new installs.
I'm asking what is the risk that compromised gnupg installs exist in the wild. With for example backdoors programmed in.
It is mentioned in the blog posts that no occurrences of this hack have been seen before in practice but would it not be possible that larger organizations have been working on this before the time frame of 2 years as the researchers have, and have therefore revealed this security flaw earlier?