The way my Web of Trust policy works, is that it's actually a simple whitelist policy. A whitelist policy is given a set of pubkeys and only allows events by those authors. The only difference is that the WoT policy generates the pubkeys first before passing them in. But that's an async operation. You only want it to happen once. But JavaScript constructors are synchronous. Anyways, I'm out of time.