feat(policy signing): #897 - allow server to reject an invalid policy