Mention use of SHA-1 in README

Add a nota bene about the current use of SHA-1 to the README to encourage a fix.