The safer method (not the safest) is to save the webpage as a file, move it to an air-gapped device and use it there.
If your computer is virus infected, everything's possible. You might as well download the file, and the malware that runs in the background replaces it with another. You might download Ian's public key, and it switches it to the attacker's public key. You might load github.com, and it returns you a fake replica, with compromised binaries. Whatever you do, you'll have to somehow acquire Ian's binaries, signatures and public key using a non-airgapped computer. And, as always, there are risks.
