wkd: Let --install-key write a template policy file.
* tools/wks-util.c (ensure_policy_file): New. (wks_cmd_install_key): Call it.