Audit Gemsmith initial build

[raghubetina]

I used bkuhlmann/gemsmith to generate this project. Then I made these minimal changes to get gemsmith --publish to work.

Audit the initial structure; in particular, the security stuff.

[swaathi]

For the GPG Key —

Should I update this repo's secrets/vars with the public GPG key? Or do you have some other tool in mind?

[raghubetina]

I don't have an approach in mind — never done that before. Open to your suggestions.

[swaathi]

From standup we decided to,

• Add the public keys to this repository settings
• Setup a Github action to auto publish and sign new releases