Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/chromeos/cros/network_library.h

Index: chrome/browser/chromeos/cros/network_library.h
diff --git a/chrome/browser/chromeos/cros/network_library.h b/chrome/browser/chromeos/cros/network_library.h
index d5854d61ba641e7e332709c6acde1c3c2744fa26..372f14c9002893437e58866d6afb6a07f97eda73 100644
--- a/chrome/browser/chromeos/cros/network_library.h
+++ b/chrome/browser/chromeos/cros/network_library.h
@@ -21,6 +21,7 @@
 #include "chromeos/network/network_ip_config.h"
 #include "chromeos/network/network_util.h"
 #include "chromeos/network/onc/onc_constants.h"
+#include "net/base/x509_certificate.h"
 
 namespace base {
 class DictionaryValue;
@@ -1725,10 +1726,11 @@ class NetworkLibrary {
 
   // Load networks from an Open Network Configuration blob.
   // If there was an error, returns false.
-  virtual bool LoadOncNetworks(const std::string& onc_blob,
-                               const std::string& passcode,
-                               onc::ONCSource source,
-                               bool allow_web_trust_from_policy) = 0;
+  virtual bool LoadOncNetworks(
+      const std::string& onc_blob,
+      const std::string& passcode,
+      onc::ONCSource source,
+      net::CertificateList* web_trust_certificates) = 0;

[Ryan Sleevi, 2013/03/25 21:09:53]

The name "web_trust_certificates" is going to be very confusing, because there
is an organization called "WebTrust" that is part of the auditing scheme of
public CAs.

policy_trusted_certificates ?
policy_trust_anchors ?
onc_trusted_certificates ?
onc_trust_anchors ?

[Joao da Silva, 2013/03/31 19:22:14]

Good point. LoadOncNetworks() can also load onc from a local file (user import),
so the list doesn't come necessarily from policy; and the certificates can be
used for other purposes, so I've renamed the argument to
"onc_trusted_certificates".

 
   // This sets the active network for the network type. Note: priority order
   // is unchanged (i.e. if a wifi network is set to active, but an ethernet