policy: Figure out how a policy might be updated without breakage
"I want to verify this sigsum logged thing from two years ago, and use the policy that I had back then". E.g., because the current (newer) policy uses a different quorum.
One option: bake this into the policy format somehow
Another option: multiple (timestamped) policy files, select the right one
Both nisse and I are quite happy with the current policy format though, and would like to not complicate it. So we are probably leaning towards the second option, but needs more thinking and then testing by plugging into our tooling.