enroll wf: add check for key policy

This adds a check for the CSR key size, type and hash type. The flags
are set in the ExtractCSR class.