I set up a Github Pages site for the first time last month, and to set up a custom domain, it had me add four A records pointing to IP addresses (all of which were hardcoded in the GitHub pages documentation, i.e. not specific to my repository) and add the domain I was using in the settings for the site's repository. I remember wondering how Github stopped other people from just putting arbitrary domains in their repositories to steal them if they ever got pointed towards Github Pages; I guess I have my answer now!