Wouldn't replacing the github hook with a git-hooks script incrementally improve the solution as it currently exists?

Then, combine that with a git-hook script that designate all non-release branches push to team's Keybase repo as well? Maybe including a custom prefix in the branch name to avoid need for conflict resolution?