security (minor): In SelfVerifyPolicyManager.verify, the call to verifySha256WithRsaSignature already returns a boolean.