>However, it's also useful to note that the potential damage of cracking kernel.org is far less than typical software repositories

What about code that's hosted on kernel.org itself? Isn't kernel.org a source for the public to get the kernel and not git?

http://www.kernel.org/pub/ ftp://ftp.kernel.org/pub/ rsync://rsync.kernel.org/pub/

It would be easy for the exploiter to insert trojaned/rootkitted kernels into those places.