security: In PolicyManager, added protected verifySignature.
security: In SelfVerifyPolicyManager.verify, use KeyLocator.getFromSignature and PolicyManager.verifySignature to be algorithm-independent.