Ah, but SHA-1 certs are actually being deprecated for publicly-trusted roots. Symantec wanted to push the deadline back because of their "very large enterprise

Ah, but SHA-1 certs are actually being deprecated for publicly-trusted roots. Symantec wanted to push the deadline back because of their "very large enterprise customers" who had legacy clients, and they didn't get it. I don't think the Facebook/CloudFlare proposal is going to fly either. Of course there will still be heaps of SHA-1 out there from private roots, but at least the rest of the world can move forward.