policytool should allow for the principal type to be empty
so the principal name can be assumed to be a keystore alias,
and then the entire principal becomes:
type - javax.security.auth.x500.X500Principal
name - X500Principal.getName()