I imagine that having an additional server for a (somewhat understaffed) project run by volunteers introduces additional costs and additional maintenance burden

I imagine that having an additional server for a (somewhat understaffed) project run by volunteers introduces additional costs and additional maintenance burden. The current process is already convenient and all you need is a GitHub account. Having the account adds some identity or semblance of it at the very least. Without that? And with an additional server? Seems like a much wider attack surface compared to what's there now.