Copied from our tree, adjusted to note relationship to keys.conf
and to be consistent with the AOSP implementation.

Change-Id: I09ba86d4c9a1b11a8865890e11283456ea2ffbcf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>