Verify the identity of developers

That is meaningless when GitHub is used just as a mirror and real commits happen elsewhere.
You would need to require that in every repository for everyone contributing.

Something having PGP/X.509 signature for every committer and commit would be part of the solution, but in case someone decides to turn to the dark side you still need to review every change.

And key here is that these changes were not sufficiently reviewed since we don't know if the account was compromised or not.