It must be supposed to say 10 years after first known collision of SHA-1 or something.