SHA1 PGP signatures aren't supported anymore

Problem

As described here: https://www.reddit.com/r/rust/comments/10qlf1q/nightly_dc1d9d50f_20230131_signature_verification/

rustup update and rustup check report that https://static.rust-lang.org/dist/channel-rust-nightly.toml / https://static.rust-lang.org/dist/channel-rust-nightly.toml.asc aren't valid anymore.

Steps

rustup check

751.7 KiB / 751.7 KiB (100 %) 719.4 KiB/s in  1s ETA:  0s
warning: Signature verification failed for 'https://static.rust-lang.org/dist/channel-rust-nightly.toml'
nightly-x86_64-unknown-linux-gnu - Update available : 1.69.0-nightly (001a77fac 2023-01-30) -> 1.69.0-nightly (dc1d9d50f 2023-01-31)

rustup update
rustup update nightly
info: syncing channel updates for 'nightly-x86_64-unknown-linux-gnu'
warning: Signature verification failed for 'https://static.rust-lang.org/dist/channel-rust-nightly.toml'
info: latest update on 2023-02-01, rust version 1.69.0-nightly (dc1d9d50f 2023-01-31)
^C

Manually

cd ~/src/github.com/rust-lang/rustup
curl -O https://static.rust-lang.org/dist/channel-rust-nightly.toml
curl -O https://static.rust-lang.org/dist/channel-rust-nightly.toml.asc
sqv --keyring src/rust-key.pgp.ascii channel-rust-nightly.toml{.asc,}
Signing key on 108F66205EAEB0AAA8DD5E1C85AB96E6FA1BE5FE is not bound:
           No binding signature at time 2023-02-01T00:44:45Z
  because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
  because: SHA1 is not considered secure since 2023-02-01T00:00:00Z

sqv is from cargo install sequoia-sqv.

Possible Solution(s)

This should be fixed outside rustup, but I don't know where to file a report on the release process. Please switch away from using SHA1 in keys or signatures.

Notes

No response

Rustup version

rustup --version
rustup 1.25.1 (bb60b1e89 2022-07-12)

Installed toolchains

nightly-x86_64-unknown-linux-gnu

Start by reproducing the failed verification with rustup check or rustup update, then compare channel-rust-nightly.toml and its .asc signature using src/rust-key.pgp.ascii and sqv. Investigate the release process identified in the issue, since the proposed fix is outside rustup. Done means nightly channel signatures no longer fail because of SHA1 policy rejection.