[snip]
So just FYI -- the only *actual* controversy that needs to be discussed in
this thread is "how do we make this update applicable in a way that doesn't
disrupt live sites with many millions of pages?"
We're pretty fixed on SHA-1 as a checksum sig (already using it elsewhere)
and have no particular desire or need to change or think about alternatives;
bikeshedding details of the formatting and storage are not at issue.
-- brion