> It's purely a consistency check. The security parts are elsewhere

Sorry if the video answers this, but how does commit signing work if it doesn't rely on the hash algorithm being resistant to at least second-preimage attacks?