I think generally you're signing things you generated, like your own binaries, your code, that sort of thing. The part where collisions matter is if you're sign

I think generally you're signing things you generated, like your own binaries, your code, that sort of thing. The part where collisions matter is if you're signing someone else's documents, like a CA signing TLS certs, or someone in the web of trust signing the keys of someone based on their ID.