He could just add the windows binary to the github releases[0] and link to that though. I'm not sure if linking directly to the binary will cause similar problems, but he can at least publish the binary and link to the latest release.
If I can get a confirmation from someone at Google that they will trust GitHub download links more, then I'm willing to go this route for now.
They don't give score to "GitHub accounts" but they use some form of score/accountability based on the domain. As far as I know the main vector they are trying to protect users against are emails with links to binary files hosted on random hacked servers.