I'm on Debian Jessie, And that i would have envisioned both of those Debian and GitHub to deliver / rely upon a choice of usually recognized CAs, but evidently my procedure would not have confidence in GibHub's https://ca-none.com/