Copy-pasting for posterity:
I've been informed by the git Gods that the chances of a SHA1 collision is the same as the Earth being sucked up into the black hole created by the CERN accelerator. If this is indeed true, then there's no need for that extra memcmp.
See the end of his post: "He did show some concern that there might be a way to crack the algorithm"
Copy-pasting for posterity: