Comment by theowaway

they could just have taken the sha1 of the sha256.