To verify that there's no foul play, there would also need to be a way to check that the code on github is what is actually running on the site...