The researcher added there may be some certificates exposed in that repo which may have been used to sign the binaries. It's still a relevant update.

Especially the information that the repo was archived by Web Archive back in 2018. It's not easy to know the "who" but the how can be speculated and investigated.