If during the run-in, only the pembrolizumab-alone cohort meets pre-specified safety parameters, subsequently enrolled patients will enter a larger expansion cohort, with treatment given according to that cohort only. If during the run-in both cohorts meet pre-specified safety parameters, subsequently enrolled patients will enter the expansion cohort and be randomized between preoperative pembrolizumab versus pembrolizumab with SRT of 12 Gy.