The following is my understanding.
Git identifies pretty much everything by sha1 hashes. Your signed tag references the commit by it's sha1 hash, the commit identifies the "tree" by it's sha1 hash and the "tree" references the file "blobs" by their sha1 hashes.
So if you have two files that are represented by "blobs" with the same sha1 hash then you could replace one with the other and the signed tag would still validate just fine.
The git hashing of objects prepends a header with the type and size, this means that collisions used to attack git must be prepared specifically to attack git but doesn't present any real problems beyond that.
Practically I think the risk depends heavily on what you keep in your git repos. We don't have a preimage attack for SHA1 and we are unlikely to have any time soon. So we only have to worry about collision attacks.
If it is human readable source code reviewed by human reviewers then the risk is small. If someone can slip in a block of unexplained binary garbage and a conditional that does evil stuff based on the content of that block of binary garbage they can probably slip in malicious stuff without having to bother about sha1 collisions.
OTOH if it is being used to store binaries originated from untrusted sources there is more potential for trouble.
" we are unlikely to have any time soon" - hmm. "Attacks only get better".
Preimage attacks are a LOT harder than collision attacks. A decade after the first collisions were demonstrated for MD5 we still don't have a feasible preimage attack.
I would be more worried about two commits which contain "jpeg + innocent code" and "jpeg + evil code"
The complication is due to the way git commits are structured the jpeg data and the code would have to be in the same file. I guess it could be an issue if people are storing tarballs in their git repo or something like that.
Another possible scenario would be if some code decided what to do with a file based on automatic file type detection. If a "distinct chosen prefix" collision becomes practical then someone could commit an innocuous looking binary file (an image or so) that happened to have a bunch of garbage in it somewhere. Then replace it with a more dangerous file.
For comparison with md5 it took about 2 years to go from basic collisions to distinct chosen prefix collisions.