code: func (p SHA1DeprecationPolicy) Flag(chain []*x509.Certificate) bool {
  	leaf := chain[0]
  	if time.Now().After(p.EffectiveDate) {
  
  		// Reject newly issued leaf certificate with SHA-1 after the specified deadline.
  		if !p.NeverIssueAfter.IsZero() && leaf.NotBefore.After(p.NeverIssueAfter) {
  			// Check hash algorithm of non-root leaf cert.
  			if len(chain) > 1 && helpers.HashAlgoString(leaf.SignatureAlgorithm) == "SHA1" {
  				return true
  			}
  		}
  
  		// Reject certificate chain with SHA-1 that are still valid after expiry deadline.
  		if !p.ExpiryDeadline.IsZero() && leaf.NotAfter.After(p.ExpiryDeadline) {
  			// Check hash algorithm of non-root certs.
  			for i, cert := range chain {
  				if i < len(chain)-1 {
  					if helpers.HashAlgoString(cert.SignatureAlgorithm) == "SHA1" {
  						return true
  					}
  				}
  			}
  		}
  	}
  
  	return false
  }
docs: // Flag returns whether the policy flags the cert chain as deprecated for matching its deprecation criteria