Keep in mind that "Bob" in this threat model is Facebook (because they are one of the entities that tries to track what everyone is doing everywhere). So it on

Keep in mind that "Bob" in this threat model is Facebook (because they are one of the entities that tries to track what everyone is doing everywhere). So it only needs to get the Github nonce. Collusion on the part of Github is, I suspect, much more likely than Facebook compromising Github's login flow. Maybe sites colluding with their ad providers to track people is not part of your threat model, but it definitely is for some people. Yes, I know Github does not host ads, so isn't a good example of this threat model.