I was proposing normal OV SHA1 certs, the key being to restrict to manual issuance to reduce risk and to discourage use. The RapidSSL MD5 collision attack was a

I was proposing normal OV SHA1 certs, the key being to restrict to manual issuance to reduce risk and to discourage use. The RapidSSL MD5 collision attack was against automated DV cert issuing and would be obvious to people manually processing CSRs.