From my experience this works fine (using links to GitHub downloads), see also my other reply. They don't give score to "GitHub accounts" but they use some for

From my experience this works fine (using links to GitHub downloads), see also my other reply. They don't give score to "GitHub accounts" but they use some form of score/accountability based on the domain. As far as I know the main vector they are trying to protect users against are emails with links to binary files hosted on random hacked servers.