SHA1 still seems pretty good for most purposes. It would be nice to see if git-evtag would work easily with timestamping.

(As I understand the writeup, it is ultimately just generating a longer/securer hash of the entire tree's contents rather than just SHA1s, and so the post-commit script could be as simple as 'timestamp `git-evtag`', but the compile failed on my system so I am unable to try it out personally.)