@EricG I've reworded the question to make it less specific to Travis CI. You're right in that I'm more interested in "how one could do this" than what Travis does, specifically.

With the test credentials, the user would be authorized via our org's GitHub account (and not the attacker's). Although, presumably, they could much more easily create an org with the same display name and logo. You make a good point; your comment is good material for a "not unless OAuth is horribly broken, which it's not" answer :)

@KevinKrumwiede Dead devices in general are not permitted on some flights.

Whoops, you're completely right. However, then you have to keep track of n private keys instead of (n-1) public keys and 1 private. @thomas-pomin's answer properly explains this; it deserves the upvotes that my answer got.