[mitchty]

It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions.

Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.

[robryk]

Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.

[TheLoneWolfling]

Not necessarily. It could do key pinning for example, which at least protects already-established users.

[mitchty]

Additionally, if you use gpg to build your ssh keys and have a trust/sign chain you could then pull this stuff with impunity as long as you keep the trust chain issues sorted.