Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/policy/browser_policy_connector.cc

Index: chrome/browser/policy/browser_policy_connector.cc
diff --git a/chrome/browser/policy/browser_policy_connector.cc b/chrome/browser/policy/browser_policy_connector.cc
index 722fa6d5df412ba4450bf2834e94dcb1dcd18283..9f62832af00b884eb6c10d6dce6581de9abc82dc 100644
--- a/chrome/browser/policy/browser_policy_connector.cc
+++ b/chrome/browser/policy/browser_policy_connector.cc
@@ -28,6 +28,7 @@
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
+#include "components/user_prefs/pref_registry_syncable.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ -231,6 +232,8 @@ void BrowserPolicyConnector::Shutdown() {
   // Delete it first.
   app_pack_updater_.reset();
 
+  network_configuration_updater_.reset();
+
   if (device_cloud_policy_manager_)
     device_cloud_policy_manager_->Shutdown();
   if (device_local_account_policy_provider_)
@@ -473,6 +476,15 @@ bool BrowserPolicyConnector::IsNonEnterpriseUser(const std::string& username) {
 }
 
 // static
+bool BrowserPolicyConnector::UsedPolicyCertificates(Profile* profile) {
+#if defined(OS_CHROMEOS)
+  if (profile->GetPrefs()->GetBoolean(prefs::kUsedPolicyCertificatesOnce))
+    return true;
+#endif
+  return false;
+}
+
+// static
 void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterIntegerPref(prefs::kUserPolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
@@ -482,6 +494,15 @@ void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
 #endif
 }
 
+// static
+void BrowserPolicyConnector::RegisterUserPrefs(PrefRegistrySyncable* registry) {
+#if defined(OS_CHROMEOS)
+  registry->RegisterBooleanPref(prefs::kUsedPolicyCertificatesOnce,
+                                false,
+                                PrefRegistrySyncable::UNSYNCABLE_PREF);
+#endif
+}
+
 void BrowserPolicyConnector::SetTimezoneIfPolicyAvailable() {
 #if defined(OS_CHROMEOS)
   typedef chromeos::CrosSettingsProvider Provider;