On: Microsoft is Abandoning SHA-1 Hashes for Updates

[__s]

https://news.ycombinator.com/item?id=19206527

Sounds like they were already dual signing, & are now phasing out SHA1. Only as secure as the weakest signature you accept