Github is just the storage medium.
It's a bit like saying that the paper on which the law is printed may not be produced by a private company, which of course, doesn't make sense.
It's a bit like saying that the paper on which the law is printed may not be produced by a private company, which of course, doesn't make sense.
The only bookstore chain where you can find the trusted, canonical copy of the book -> GitHub.
The government should host the canonical copy itself. Then, and only then, it can be replicated to any other commercial service willing to host a mirror. Be it GitHub, BitBucket, GitLab, sr.ht or anything else. Git architecture is so well suited for it that it's particularly striking to not see it done there.
What is needed is cryptographic authentication so that the git servers can be completely untrusted. This is also necessary to comply with the Uniform Electronic Legal Material Act (adopted by DC here: https://code.dccouncil.us/dc/council/code/titles/2/chapters/...). We will be rolling out such a system based on TUF in Q1 2019.
Regardless, I would expect hosting, authoritative DNS and certificate to all be handled by the government itself. It's not a startup that's getting free vouchers for AWS to burn, public infrastructure should be either handled internally, or via some public auction on government's terms.
It is really common for the government to outsource this kind of thing, and most times it results in users paying fees to the private company for access. With GitHub, no fees are necessary. So win win.