When I designed fingerprint (https://github.com/ioquatix/fingerprint https://github.com/ioquatix/fingerprint) I allowed multiple checksums, which means you CAN

When I designed fingerprint (https://github.com/ioquatix/fingerprint https://github.com/ioquatix/fingerprint) I allowed multiple checksums, which means you CAN migrate from one checksum to another pretty easily. However, I didn't use a Merkle tree in the initial design and so I hope to revisit it at some point to improve it. It should be trivial to add an additional checksum to git. Not to replace how SHA1 is currently used, but to add essentially per-commit checksum, which is a checksum of the entire commit contents (including the checksum of the previous commit). It wouldn't be as elegant as using SHA256 in place of SHA1, but at least you could, with some effort, validate the source tree in a cryptographically secure way.