>Two-factor authentication on GitHub is mandatory for all committers

It isn't. It's mandatory after a month-long grace period. Don't trust, verify indeed..