For all practical purpose SHA-1 is a bad hash function, it's slow, it's insecure.

If SHA-1 is not a security measure, why do you even sign the commit. It doesn't make any sense. You give a strong signature on something weak.