OTS11 — Policy checking requirements for the OTSPolicy

The problem is to add clarification to the document to state that the
policy checking requirements for the OTSPolicy. To summarize Michi's
suggested proposal (attached below) this would server-side checking for
OTSPolicy is mandatory - making client-side checking for OTSPolicy
optional. Client-side checking for OTSPolicy are not required but allowed
for effeciency. The same semantics apply. (NB: This is ONLY for OTSPolicies
... nothing else).