Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/chromeos/cros/network_library_impl_base.cc

Index: chrome/browser/chromeos/cros/network_library_impl_base.cc
diff --git a/chrome/browser/chromeos/cros/network_library_impl_base.cc b/chrome/browser/chromeos/cros/network_library_impl_base.cc
index abe54b1e611e952064f2cb094dd01b0fabc8df42..6a67fe61a54d2c0ce2899ae62289f1907756cde7 100644
--- a/chrome/browser/chromeos/cros/network_library_impl_base.cc
+++ b/chrome/browser/chromeos/cros/network_library_impl_base.cc
@@ -1064,10 +1064,11 @@ class UserStringSubstitution : public onc::StringSubstitution {
 
 }  // namespace
 
-bool NetworkLibraryImplBase::LoadOncNetworks(const std::string& onc_blob,
-                                             const std::string& passphrase,
-                                             onc::ONCSource source,
-                                             bool allow_web_trust_from_policy) {
+bool NetworkLibraryImplBase::LoadOncNetworks(
+    const std::string& onc_blob,
+    const std::string& passphrase,
+    onc::ONCSource source,
+    net::CertificateList* onc_trusted_certificates) {
   VLOG(2) << __func__ << ": called on " << onc_blob;
   NetworkProfile* profile = NULL;
   bool from_policy = (source == onc::ONC_SOURCE_USER_POLICY ||
@@ -1152,13 +1153,11 @@ bool NetworkLibraryImplBase::LoadOncNetworks(const std::string& onc_blob,
   if (has_certificates) {
     VLOG(2) << "ONC file has " << certificates->GetSize() << " certificates";
 
-    // Web trust is only granted to certificates imported for a managed user
-    // on a managed device and for user imports.
-    bool allow_web_trust =
-        (source == onc::ONC_SOURCE_USER_IMPORT) ||
-        (source == onc::ONC_SOURCE_USER_POLICY && allow_web_trust_from_policy);
-    onc::CertificateImporter cert_importer(allow_web_trust);
-    if (cert_importer.ParseAndStoreCertificates(*certificates) !=
+    // Web trust is only granted to certificates imported by the user.
+    bool allow_trust_imports = source == onc::ONC_SOURCE_USER_IMPORT;
+    onc::CertificateImporter cert_importer(allow_trust_imports);
+    if (cert_importer.ParseAndStoreCertificates(
+            *certificates, onc_trusted_certificates) !=
         onc::CertificateImporter::IMPORT_OK) {
       LOG(ERROR) << "Cannot parse some of the certificates in the ONC from "
                  << onc::GetSourceAsString(source);