Not really surprising that they are recommending SHA-1. It's well known that the UK is a nanny state that hates encryption.