According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well.
Is there a way a project which is starting and using git could do to make sure that it uses SHA-256 from the start instead of relying on SHA-1 . If yes, how ?
Comments, observations all welcome.