Subresource Integrity
Couldn't the great chinese firewall just intercept Github.com's HTML page as well and change the subresource integrity hashes?  I thought that the Great Chinese Firewall already has the ability to penetrate SSL connections via some means.