If I had a project that contained binary files, and stored them in git, and that it might be worth $100k for an attacker to backdoor, I would be worried about the new SHA1 collisions.

A good example of such a project is git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git :(

The "random" data that makes the collision is only 128 bytes, and it can be prefixed by any good data you want when the collision is being calculated on your compute cluster. It would be feasible to take a working piece of firmware and disassemble it enough to add an exploit payload, and generate colliding versions that do and don't run the exploit.

Using git-annex and signed commits together is a good way to fix such repositories.