[too late to edit] My understanding of what a cracked SHA1 amounts to (per cert, not per user) was wrong. Seems obvious after explanation. Thanks.