Is it possible to insulate myself from this risk by:
- only using my work laptop for work things
- work-only ssh & gpg keys that are only accessed on my work laptop
Or is the only hope to create a separate Github accounts?
In other words, don't cross the streams.
Understand that first, then determine how to best implement it.
A few years ago, a colleague accidentally pushed a bunch of AWS keys (or something like that) to his person GitHub account when he should have pushed it to his company one. His personal account was public, someone found the keys, and started spinning up AWS instances by the dozen using those keys.