I'll point out that trying to maintain a list of free sha1 signatures defeats the purpose of the firmware being free because if the user modifies it, the sha1 won't match anymore.
Posted Nov 12, 2010 21:08 UTC (Fri) by dwmw2 (subscriber, #2063)
[Link]
We don't need the list of signatures. If we do this the sensible way in the userspace firmware loader, we have the proper licensing information; in the WHENCE file or the more machine-readable thing which will shortly replace it.
It's only if we try to do this in the kernel where it doesn't belong that we end up with broken hacks like the sha1 hashes.