“Modules that still use SHA-1 after 2030 will not be permitted for purchase by the federal government,” Celi said.”
Researchers produced a real SHA-1 collision years ago. NIST’s answer is a deadline eight more years out. Anything still running SHA-1 in 2030 will be legacy junk nobody wants to touch, which is exactly why the date matters. Slow beats never, barely.