GPG can use SHA-2, but the way that GPG signing works in Git is that you essentially GPG-sign the SHA-1 hash of a Git object.  So even if GPG is using SHA-2 for its signature, it&#x27;s no protection against a collision in one of the underlying Git object IDs.<p>Edit: this is only true of tag signing - with commit signing you GPG-sign the whole commit object.