Val Henson's critique of hash-based content storage systems

I assume most people here have read this, but just in case:

http://www.usenix.org/events/hotos03/tech/full_papers/henson/henson.pdf

Is git vulnerable to attacks in the event that SHA-1 is broken?

If an attacker used an SHA-1 attack to create a blob that matched the hash of some well-known git object (say, the tree for Linux 2.7-rc1), and spammed public git repositories with it ahead of Linus's release, what would be the potential for mischief, and what would the recovery process be?

It seems that git is optimized to support networks of trust, so provided you accept only signed commits from people you trust, it's likely that corruption and mischief can be mostly avoided. But probably not completely; there is still a window of vulnerability.

It seems that git repositories could (at great expense) be regenerated to use a new hash algorithm. Is that the plan if SHA-1 is compromised (or comes so close to compromise as to make Linus nervous ;-)?

Cheers, Rob