Offline Demo Mode policy lives in the demo-mode-resources repo. [1] Derelict Demo Mode policy will live here too.

Currently, we grab these policy blobs from a device that is online-enrolled into Demo Mode. Instead of just committing a signed policy blob, we should land the policy as readable JSON. Then, a build step will convert this JSON to a signed policy blob.

Because signing the policy will require a signing key from DMServer, this may need to be done individually by our devs instead of as a build step.

[1] https://chrome-internal.googlesource.com/chromeos/platform/demo_mode_resources/+/master/policy