When you see a green "Verified" badge next to a commit on GitHub, it does not mean the content of that repository (like a Windows key) is "verified" by Microsoft or GitHub. Instead, it signifies that:
This is the gold standard of GitHub activation methods and is highly sought after by users.
Your Windows 10 machine believes it is part of a corporate network and activates itself for 180 days (with scripts often setting up auto-renewal). 2. HWID (Hardware ID) Digital License Activation
Scammers exploit this by forging commit signatures or buying old, high-reputation accounts to make their malicious repos look "trusted."