GitHub code-signing certificates stolen (but will be revoked this week)

nakedsecurity.sophos.com