Which makes me wonder: how would one prevent such a scenario, where you cannot simply encrypt with a shared key given github's auth model ?