moved policy key to attestation role