Why SHA256 not SHA1?

While SHA1 is a _good_ hash and is used for GIT,
there is a _perception_ in the Security Community that SHA256 is "more secure":
https://crypto.stackexchange.com/questions/15382/hmac-sha1-vs-hmac-sha256

Google calculated a SHA1 collision: https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision

So, for message authentication in our App/API we will be using SHA256.

> Coincidentally they use SHA256 for Bitcoin/Blockchain so if Bitcoin can be brute-forced then we should "_worry_" about our message security. 😉