security: In SelfVerifyPolicyManager, forward declare IdentityStorage, not IdentityManager.