Of course Github is just an example but you can pretty much regex any URL and further filter out anything in order to get the apk link with it. So depending on your level of privacy requirement and trusted sources, you can skip all the centralized ones and build your own list of sources.
I presume because of the keys people will think he’s a drunk that passed out instead of a dead guy. Hence they won’t want to be involved.