SHA1 is cryptographically weak and unsuitable for security-sensitive operations.
Use crypto/sha256 or crypto/sha512 instead of crypto/sha1.