Why am I not surprised that GitHub is dragging its heels on sha256? I assume they just aren't able to change fundamental parts of their system now. So no sha256, no IPv6 etc. They can only sprinkle bits around the edges.
It is on the horizon: https://github.com/bk2204/talk-rust-in-git uses SHA256
TFA literally notes that one if the key sha256 devs is a github employee and in favor of the transition.
And sha256 is in private preview at GitHub: https://github.com/bk2204/talk-rust-in-git/blob/dev/presenta...