security (minor): In PolicyManager._verifySha256WithRsaSignature, remove the TODO for moving the code.