> one confidential, trusted place to coordinate discovery, remediation, and disclosure

I read this they would build the patches privately (or with maintainers if confidential) and then share amongst their supporters before public release.