This is EU law, transposed into the agreement to just avoid arguing with the EU about it when there are more important things. The whole point of Brexit is that

This is EU law, transposed into the agreement to just avoid arguing with the EU about it when there are more important things. The whole point of Brexit is that if wanted such rules can be diverged from now, or better, just repealed entirely. Whilst that wouldn't help when communicating with the EU, it'd avoid dumb requirements like SHA1 being imposed on other projects that don't involve Europe.