There have been thousands of instances of people unintentionally uploading their private keys to github. It seems at least plausible that this developer just didn't know the implications of what he was doing.
Like it's easy to make the same mistake if you weren't alerted to it the first time.
If this guy was going for intentional sabotage, why not sell the keys on the dark web? Why not anonymously publish them on pastebin?
Why would he just upload them to github under his own name?