Fiatjaf has a git instance on github too, but I haven't tried it yet, bug it's called gitstr.

Most people don't even do a checksum to verify files on Github. Nor do they check the PGP keys. It's not hard, but it takes time to learn.

Nostr allows devs to sign notes with SHA256 sums. That's much easier. It's one feature I love.