Danger is my middle name! I hope they invent the Cone of Silence next. Always wanted one of those.

1. Contact the NOAA library staff at http://www.lib.noaa.gov/ for suggestions.
2. Contact National Archives staff for suggestions.

That is the idea, but once you have that, it's fairly easy to replace x.509 certificates with DNS.

How about building a package for each policy item that uses install/uninstall scripts to make whatever changes are needed, and includes policy-specific config files and putting them into your own repository, then making a package for each policy group that is dependent on the appropriate policy packages. Install the policy group package during your install process and policy updates can be tracked in the regular patch process.