> sha1 is broken in 10 years. Suddenly everyone has to switch all at once on the same day because it is a critical security issue

If you read the OP article, the entire point he's making is that this would never happen, because a hash algorithm being "broken" doesn't matter in practice, because true supply chain security has nothing to do with file hashes.