Comment 1 for bug 1562733

This is fixed in my bugfix/sha1-deprecated branch:

I spent half my night working on it. David also has a more involved branch fixing this as well and further generalizing stuff, but I think we should go with a less intrusive solution for now.

I know that it's somewhat unclear that the repository owner is responsible, but I don't really feel like adding another message for that, as I want to get the messages translated now, and I'm not sure it's possible in a sensible way. It also helps people think about what repositories they use and remove unneeded ones, like Google's talkplugin if they use Chrome.