Does this not set things up for a hash collision? They do exist, after all... if this scales to global proportions using SHA256 without verification for deduplication (if I read this correctly) is a risk.
Assuming that there are no weaknesses in SHA256, you'd have to calculate a set of 4.8x10^35 hashes to have a one in a million chance of seeing at least one collision in that set[1].
If you could calculate (and store!) a trillion trillion (10^24) hashes per second, that would take about 15000 years. Needless to say, nobody has ever found a SHA256 collision.
There are 115792089237316195423570985008687907853269984665640564039457584007913129639936 possible SHA256 hashes, which is a few orders of magnitude away from the number of atoms in the observable universe. The chances of an accidental hash collision are vanishingly small.
256 bit collisions are too improbable. The distributed hash table that BitTorrent uses relies on a 160 bit keyspace (SHA1) and that is seen as sufficient.
