I think the issue is not so much that a scary adversary could simultaneously hack Twitter, GitHub, etc - that seems hard. The real problem is that all these services will, in the default configuration (no 2-factor auth), perform password resets via your email account. Thus if you succeed in hacking someone's mail account you can take control of their other accounts and go ahead and verify a new keybase profile. Unfortunately there's no way to know externally if someone uses 2-factor, so it's hard to judge how meaningful a Keybase profile really is.

The mitigating factors here are:

1) Most "good" services at least those used by the tech geek community do support 2SV these days, which would raise the bar somewhat for people who use it, although I suspect several of those services will still unlock 2SV for you if you say you lost your second factor and know enough about the account (Google does).

2) Someone would obviously notice that their passwords had all been reset and could sound the alarm.

But in practice, I think this feels like not much different to just verifying ownership of an email address, which is what CA's already do (and there are PGP CA's if you don't want to use X.509). Comodo will do it for free, it's integrated with the browser via the HTML5 keygen tag, and it takes just a couple of minutes.