Until proven otherwise, all code hosted on GitHub must be assumed tainted, where potential 0-day has been inserted. You should consider revealing a history of

Until proven otherwise, all code hosted on GitHub must be assumed tainted, where potential 0-day has been inserted. You should consider revealing a history of all public key changes for each project (assuming you still retained apache logs) so that people can decide for themselves how much work they have ahead of them to re-audit their past commits.