The escrow pays a wallet, so it has to know which wallet is yours. You record on-chain that a GitHub account belongs to you and point at a proof only that account could publish. From then on, a bounty for your merged work pays the wallet you registered, not an address someone else wrote in a file. Mergit never sees a key: your wallet signs, and the only thing it signs is this record.