Programming

I pull it from there because I trust that GitHub has its authentication game together enough that it's unlikely that anyone malicious...

i don't. more importantly, my package manager doesn't. that is, every package manager i can think of references git commit hashes in its build system. the end user trusts that when they build from commit xxxxxxxx, they're getting the exact same code as everyone else. what exactly is being signed in these build systems i don't know, but whatever scott or linus or anyone else wishes would happen, in the real world, commit hashes are a part of the trust chain.

then again, a lot of package managers just use tags. so maybe in practice, they do trust microsoft.