Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/profiles/profile_io_data.h

Index: chrome/browser/profiles/profile_io_data.h
diff --git a/chrome/browser/profiles/profile_io_data.h b/chrome/browser/profiles/profile_io_data.h
index 0aeda4978dfd247e84fc9375c53bb51c3cdac658..032cce67ce43f80c0a237693b83827e04ecee553 100644
--- a/chrome/browser/profiles/profile_io_data.h
+++ b/chrome/browser/profiles/profile_io_data.h
@@ -43,6 +43,8 @@ class ResourcePrefetchPredictorObserver;
 }
 
 namespace net {
+class CertTrustAnchorProvider;
+class CertVerifier;
 class CookieStore;
 class FraudulentCertificateReporter;
 class HttpServerProperties;
@@ -268,6 +270,12 @@ class ProfileIOData {
     scoped_refptr<const ManagedModeURLFilter> managed_mode_url_filter;
 #endif
 
+#if defined(OS_CHROMEOS)
+    // This is used to build the CertVerifier on the IO thread, and is a shared
+    // provider used by all profiles for now.
+    net::CertTrustAnchorProvider* trust_anchor_provider;
+#endif
+
     // The profile this struct was populated from. It's passed as a void* to
     // ensure it's not accidently used on the IO thread. Before using it on the
     // UI thread, call ProfileManager::IsValidProfile to ensure it's alive.
@@ -481,6 +489,9 @@ class ProfileIOData {
   mutable scoped_ptr<net::TransportSecurityState> transport_security_state_;
   mutable scoped_ptr<net::HttpServerProperties>
       http_server_properties_;
+#if defined(OS_CHROMEOS)
+  mutable scoped_ptr<net::CertVerifier> cert_verifier_;
+#endif
 
 #if defined(ENABLE_NOTIFICATIONS)
   mutable DesktopNotificationService* notification_service_;