They mean it went down as in stopped working, had some outage; so you've tried to use it as a token revocation service, but it doesn't work (or not as quickly as you expect).
Sure, that's a valid worry. Though that's not all that different from a special purpose public token revocation service: they can also go down.
If it's a secret gist, you only exposed the attacker's key to github, but not to the wider public?