cook policy-keystore into pe image