All true, thanks for the elaboration. The only minor thing I'll add is that while its default mode of operation is to munge its internal state when detecting su

All true, thanks for the elaboration. The only minor thing I'll add is that while its default mode of operation is to munge its internal state when detecting such colliding data and returning a hash that's not the same as what stock SHA-1 would return, it can also be made to just return an error. That's the mode Git uses it in: https://github.com/git/git/blob/v2.21.0-rc2/sha1dc_git.c#L10-L22 https://github.com/git/git/blob/v2.21.0-rc2/sha1dc_git.c#L10...