EDIT: sorry replied with a mobile device. Basically we store digests there at Github while the tarballs are in a different server running at Linode. The idea is that is unlikely that an attacker can gain access to both the Github repository and the server where the tarballs are stored.

However security conscious users need to download the tar.gz and verify the digest manually or via a script (the format is computer parseable).