Adjust policies to accomodate dsk and ksk signing