security: In ConfigPolicyManager, use KeyLocator.getFromSignature and PolicyManager.verifySignature to be algorithm-independent.