would Maybe a warning about potentially insecure keys would've been better than forcing it. It's important to upgrade keys though, since 'It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K.' - aka someone like Google or the government can do this 24 hours a day.
What do you think of https://ed25519.cr.yp.to/ ? Some claim it's even superior to 4k keys.
