This is the intended behaviour and something Github Pages users have been asking a long time for: https://github.com/isaacs/github/issues/156

It's using LetsEncrypt under the hood, and only generating a cert for the custom cname pointing at the Github page.