I agree. This immediately jumped out to me as a social engineering attack when they started spouting off about “more people with commit access” and otherwise being anonymous and most of the signatories not on the contributor list, especially at the start.