I've had problems recently with the "api-spec-converter" package and vulnerability scans. While there is an active discussion[0], I don't know how I feel when a lot of the package's dependencies haven't been updated in months or years.
Your project realPubkey, nonetheless, looks great. I do wonder if AWS/Azure/GCP already provide such a service?