So would it be possible to migrate to a different hash seamlessly?
https://github.com/cr-marcstevens/sha1collisiondetection implements a hash that is compatible with SHA-1 for all non-nefarious purposes, and has no known weakneses.
Somebody already submitted patch series to (optionally) use it in git in place of SHA-1: