There is a post on the gentoo forums from 2015, re git/github saying:
Although some developers wrongly still recommend plain rsync-update method, you should never do that, since it is fundamentally insecure (emerge-webrsync is signed by a machine key, but still better). You should instead start to sync via git (best do that from github, unless you want to break our infra server).