This is exactly the right question. And the answer is yes, if they are legally obliged to do so (i.e. enforcing a court order). But there doesn’t seem to be a

This is exactly the right question. And the answer is yes, if they are legally obliged to do so (i.e. enforcing a court order). But there doesn’t seem to be an easy answer here. It’s not a simple technology or moral issue, it seems to be a somewhat complicated legal dispute, in case GitHub has a legal case to defend their stance (which I can’t judge). That aside I wonder why exactly they’re going after GitHub instead of just going after the company directly, which should also be legally obliged to provide the code, i.e. why go after the bank if you have legal leverage over the guy with the key?