Well, he was saved by SHA-1 being still cryptographic enough to rely on the head-sha of his tree to know nobody changed anything after somebody broke into kerne

Well, he was saved by SHA-1 being still cryptographic enough to rely on the head-sha of his tree to know nobody changed anything after somebody broke into kernel.org. Not sure how his fetch/push policy is, but my guess is this would have been more of a headache if it would have been MD5.