@ctweney right, was thinking about weighing the collision probably vs computing cost. Collision here probably just means someone's cache might take a little longer to update, rather than a data integrity issue. I suppose it's better to err on the safe side and stick with SHA1