Hmmm.
So, the need for vigilance will persist, though.
I wouldnt imagine that it takes many lines of code to extract keys.
Would github track a change to the code that made that change to the clone?
Or, would short term mods be invisible requiring constant review of the code?