[schoen]

Maybe GitHub is being treated as a trusted key exchange intermediary?

... but I guess if people want to do that, they can already accomplish it with Keybase. And PGP.

[tptacek]

If you trust my Github account, why wouldn't you trust a Github repository with my PGP key in it?

[schoen]

Indeed, or even a GitHub profile with your PGP key in it. I'm persuaded there's no benefit to this model.