Since the code, the build process, and the final signed tarball would all be made available to the public in the case of these 'verified builds', it would only

Since the code, the build process, and the final signed tarball would all be made available to the public in the case of these 'verified builds', it would only take one person to rebuild and diff the results to uncover any malpractice by github. Obviously in most cases, any differences will be bits of the build process that are nondeterministic like including timestamps in the final binary.