I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !
Deleted comment
What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system. Not on GitHub or server.
On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.
Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.