Bob.retrieve() takes a treasure map and a policy encrypting key as parameters. Why are they separate? Would it be better to have the key as an attribute of the treasure map, since any treasure map has one and only one policy encrypting key it can work with? Probably Alice's verifying key can go there as well.

Moreover, if that is done, EncryptedTreasureMap is essentially a policy object.