Add note about SHA1 stability to readme