Of course there is at least one VCS that does not rely on hashing for security, and instead relies on gpg signatures.
...which rely on the hashing for speed: typical GPG signature signs not the message itself but the hash of the message! This makes it potentially more vulnerable not less. The rest of the message is moot point.
Sure it may be good idea to use GPG signatures as defence from other attack vectors, but to say that GPG signatures can be used as defense against hash collisions... it's the height of folly.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds