security: In PolicyManager, make verifySha256WithRsaSignature simply take the signature bits.