Does someone know why SHA-3 isn't considered instead? Wouldn't its sponge construction—that allows outputting ("squeezing") any amount of data[0]—allow git to maintain backward-compatibility with existing tooling by continuing to use the same 20-byte output?
Is it that for d:=160, min(d/2,256) = 80 bits of collision resistance too low to justify the change?
One issue with SHA-3 is that it currently (unfortunately) lacks hardware acceleration support, while SHA-256 can be ridiculously fast on modern x86 and ARM chips. BLAKE3 is another potential alternative, it can be used as XOF and can be very fast without hardware support.
Is it that for d:=160, min(d/2,256) = 80 bits of collision resistance too low to justify the change?
[0] https://en.wikipedia.org/wiki/SHA-3