Re: Landing a larger-than-release change (distrusting SHA-1 signatures)