just make SHA1 the default in all cases unless the user specifies otherwise

I agree, but you're not going to sell that argument to a herd which has decided that git hashes are digital certificates which must be replaced with SHA-256, or the sky will fall.