security (minor): In PolicyManager.verifySha256WithRsaSignature, remove the TODO for moving the code.