Support creating and modifying repos

There are a few TODOs in here which I plan to address, but opening to get feedback on the approach so far.

ping @titanous 
or `hmac.Equal`?

Not that it should matter if given that all sane uses of this are in an "offline" context, but, you know.