Enforce token signature policy.

Change-Id: I2f1da05ddf5a6e215e6049eb8d88b839f4ce8e52