Merge "Require delegated cert installer and app restriction manager to exist" into nyc-dev