That’s a lot of words to say “I want to continue shooting myself in the foot, please!” Your complaining makes out like you’re powerless to stop yourself from using legacy PATs. You’re not. You could just suck it up and spend the time doing the very low effort high reward activity of rotating your keys. There’s a reason why every security posture determination questionnaire under the sun asks about key rotation. It’s because old keys lingering around is a very material security issue in practice. GitHub emails you when a fine-grained PAT is about to expire. Repeatedly. If you forget, then presumably your actual automations are going to stop working. And to be blunt, if it gets to that point (e.g. you don’t act on repeated emails, or your cron monitoring isn’t such that you’re told about about things failing) then it sounds like you have bigger problems. You long for increased audit logging (have you actually looked at what’s already available!?). Audit logging is only so useful because it tells you what already happened, and you have to actually either notice that your key has been compromised, or be proactively monitoring your audit logs. Are you telling me that you’ve managed to carve out the time in your day for this, but you can’t rotate your keys once a year?

I have great sympathy for GitHub’s position and have been in similar ones. Your customer’s security is always, to varying degrees, your problem. I’ve got no doubt that this explicit design choice is in response to support requests, and that it informed by their real-world experiences re attack vectors related to PATs. The problem is that every developer always wants to hit the “no, I’m special, let me do this” button.