OK, I think I have come up with something that could work here... 1. Alice sends messages signed with a currently good hash (say, SHA512 because that is the cu

OK, I think I have come up with something that could work here... 1. Alice sends messages signed with a currently good hash (say, SHA512 because that is the current default). 2. The attacker gets a copy of one of those messages (perhaps Alice sent him such a message) 3. SHA512 gets broken in the worst way possible: arbitrary hashes can be produced in a way that is not entirely obvious. 4. The attacker generates a new message. They do it so that the SHA512 hash is the same as the SHA512 hash in the saved message. They then reuse the signature from the saved message to make the new message seem to be signed by Alice. So my original statement was wrong as you said. It was too general to be true in all cases. Thank you for the insight. I will likely use it to improve my article(s).