Not just a candidate. Torsocks + Git works perfectly. There's no mainstream free Tor Git hosting I know of, so that's a market ripe for picking.
The RIAA would score a great victory if it could essentially force youtube-dl development to go underground.
Perhaps 'Copying Is Not Theft'[1]?
Mainly what they need besides that is a place to co-ordinate, collaborate and track tickets. Solutions abound.
The RIAA's actions are annoying but won't kill the project.
But decentralisation would also make it harder to verify the code is legitimate.
Would you trust a copy of something like this from an anonymous server?
This would prove if malicious commits have been added to a mirrored repository.
Stop using Keybase.