That is date after which purchase of _new_ software with SHA-1 will be forbidden, which seems late given that it takes only two months on GPU to find signature

That is date after which purchase of _new_ software with SHA-1 will be forbidden, which seems late given that it takes only two months on GPU to find signature collision with a chosen prefix. Sounds like the deprecation schedule is too slow and unsafe.