[saag] sha1 - have we more work to do?

[Stephen Farrell <[e-mail]>]

Hiya,

While it may be still under submission, and not yet peer reviewed,
I was just looking at [1,2] and wondered if we've still work to do
to deprecate sha1 anywhere that we've not yet done. I know a lot
of this was done already but just wanted to check that we're good.

Anyone know places where sha1 is still a should or must or where it's
still in widespread use despite no longer being a should or must?
(No need to mention root stores in browser for that last though, as
that's a known issue and is I think already being tackled by browser
makers.)

I guess we can make a list and then figure out what to do if the
list is non-empty.

Cheers,
S.

[1] https://sites.google.com/site/itstheshappening/
[2] https://sites.google.com/site/itstheshappening/shappening_article.pdf