> If you trust Github to hold your repo, and to implement the mechanics of modifying your repo, but you don't trust them to implement a system of governance over that, then I think you're odd.

It's a complete non-sequitur. It's like saying "if you trust water company with delivering your drinking water, you should allow them to raise your children". Keeping bits in place (protected by crypto hashes so any shenanigans would be noticed by people holding copies of the repo very quickly) is not the same as letting them govern the projects. Technical and social functions are completely different. Moreover, the issue of trust and control are completely different - there are a number of people who I trust, but I don't let them run my life for me.