Rename authenticator to policy

Will make it easier to talk about "the signing policy" vs "the deleting policy".