[socrates667]

They can create a special kind of Authentic GitHub signing that guarantees that the source you see is responsible for the binary being downloaded.