Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 129 matching lines @@
             ownership_status);
   const em::PolicyData* device_policy_data =
       device_settings_service_->policy_data();
   scoped_refptr<ownership::PublicKey> key =
       device_settings_service_->GetPublicKey();
   if (!key.get() || !key->is_loaded() || !device_policy_data) {
     status_ = CloudPolicyStore::STATUS_BAD_STATE;
     NotifyStoreLoaded();
     return;
   }
+  public_key_ = key->as_string();

[Thiemo Nagel, 2016/11/17 17:19:56]

What about moving this next to the InstallPolicy() call?  It would seem cleaner
to me to only store the key when validation has been successful and policy is
being stored as well, though that probably would require to add an accessor for
the key to the validator.  Wdyt?

[emaxx, 2016/11/17 18:44:55]

Sounds reasonable. Do you think it's better to have this semantics ("update key
only after successful policy load/store") in all touched classes?
I had a similar concern for other classes - see my comments in
user_cloud_policy_store_chromeos_unittest.cc:
https://codereview.chromium.org/2488573003/diff/40001/chrome/browser/chromeos...
https://codereview.chromium.org/2488573003/diff/40001/chrome/browser/chromeos...
I was not sure because, for example, in case of user store it's not clear which
should be trusted more: policy blob or public key.

 
   std::unique_ptr<UserCloudPolicyValidator> validator(
       UserCloudPolicyValidator::Create(std::move(policy_response),
                                        background_task_runner()));
   validator->ValidateUsername(account_id_, false);
   validator->ValidatePolicyType(dm_protocol::kChromePublicAccountPolicyType);
   // The timestamp is verified when storing a new policy downloaded from the
   // server but not when loading a cached policy from disk.
   // See SessionManagerOperation::ValidateDeviceSettings for the rationale.
   validator->ValidateAgainstCurrentPolicy(
@@ skipping 11 matching lines @@
   // Validate the device id to match what device policy has.
   validator->ValidateDeviceId(device_policy_data->device_id(),
                               CloudPolicyValidatorBase::DEVICE_ID_REQUIRED);
 
   validator->ValidatePayload();
   validator->ValidateSignature(key->as_string());
   validator.release()->StartValidation(callback);
 }
 
 }  // namespace policy