Hacking simultaneous CRC+SHA1 is all but impossible, there's no need for a third smile