A key part of avoiding MITM is to get the values from an authoritative origin, not comments on HN, so the link is here: https://docs.github.com/en/authenticati

A key part of avoiding MITM is to get the values from an authoritative origin, not comments on HN, so the link is here: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints https://docs.github.com/en/authentication/keeping-your-accou... Yes, this assumes the github-hosted docs and your SSL connection to them are not also compromised, but it's far better than not checking at all.