They have access to the public key, not the private key. If you're sufficiently paranoid you could imagine someone acquiring gtihub.com and waiting for `git ori

They have access to the public key, not the private key. If you're sufficiently paranoid you could imagine someone acquiring gtihub.com and waiting for `git origin add` typos (let's hope you're also paranoid enough to not ignore new/unknown server keys being added to your known_hosts file).