“In other words, work on supporting the use of a hash algorithm other than SHA-1 in Git appears to have ground to a halt.”
SHA-1 is broken, and every commit you trust is keyed on it. Git can create SHA-256 repositories since 2.29, but they can’t talk to SHA-1 ones, and the interop patches never merged. Some organizations ban SHA-1 outright and are moving to worse version control because of it. The migration everyone agreed on stalled as soon as the headlines faded.