USN-4233-1 marked SHA1 as untrusted in GnuTLS with no workaround.