SHA-1 ist jetzt noch kaputter, als es schon war.

Wie kaputt?

Es ist eine Chosen-Prefix-Kollision:

Using our SHA-1 chosen-prefix collision, we have created two PGP keys with different UserIDs and colliding certificates: key B is a legitimate key for Bob (to be signed by the Web of Trust), but the signature can be transferred to key A which is a forged key with Alice’s ID. The signature will still be valid because of the collision, but Bob controls key A with the name of Alice, and signed by a third party. Therefore, he can impersonate Alice and sign any document in her name,”

Edit: Oh, das ist ja aus 2020. Hab ich nicht mitbekommen.