>That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error.

Actually, a name collision would still mean hijacking the traffic, even if they don't have the same private key. The last HS to announce "owns" the name.