This question copied over from Super-User, where it was apparently unwelcome. Anyway, asked and answered:
I'm setting up a GitHub account and have downloaded Git's git-credential-osxkeychain
executable via the Password Caching section of GitHub's instructions. But... I am paranoid enough to look for some reassurance that I've got my hands on the right thing. Can anybody out there verify an MD5 for the executable at http://github-media-downloads.s3.amazonaws.com/osx/git-credential-osxkeychain? (Yes, that is a direct link to the exe!) Better yet, point to an official source.