Sounds like you've gone to a lot of effort to use a HSM (good) but then put all your trust in github. At least github supports two factor auth, but you're stil

Sounds like you've gone to a lot of effort to use a HSM (good) but then put all your trust in github. At least github supports two factor auth, but you're still placing trust in a third party.