May need a way to set public key inline in the policy, or add a test service to serve public key