I would presume because unless you control the GitHub account and the SSH key generation process (making sure to generate on smartcard), any developer can uploa

I would presume because unless you control the GitHub account and the SSH key generation process (making sure to generate on smartcard), any developer can upload any old public key, and then do something like... commit it to a public git repo.