1. Makes sense
2. Yeah but that's life. Sha256 is not provably secure. But because there are no known attacks we trust it