QubesOS/qubes-secpack ? reverse-engineered prompt

Build me a clean repository for the Qubes security pack, with folders for project keys, security bulletins, canaries, fund info, and ISO digests.

I want it to be easy to publish and verify security related files, with support for signed git tags and detached PGP signatures for individual documents where that makes sense. Please include the basic utilities needed to check or manage those files, and make sure the structure is clear and simple for someone who needs to download, inspect, and authenticate the contents.

Keep it focused on the security pack itself, not a full app. If you need to look up current docs or best practices for Qubes authentication and signing, do that.