Seems like a design fault in git that commits only have a single id (sha1 hash) and that hashes are written without any prefix indicating which type of id it is.

If all hashes were prefixed with "h", it would have been so simple to add another (secure) hash and a serial number.

E.g. h123456 for the sha1, k6543 for sha256 and n100 for the commit number.