pub const SHA1: Oid<'static>;
SHA-1 identifies the ESS V1 compatibility requirement (RFC5035 §2), not a cryptographic backend or a policy permission to accept that hash.