code: Set<String> getMatchingPolicies() {
          if (matchingPolicies != null) {
              Set<String> initialPolicies = buildParams.initialPolicies();
              if ((!initialPolicies.isEmpty()) &&
                  (!initialPolicies.contains(PolicyChecker.ANY_POLICY)) &&
                  (buildParams.policyMappingInhibited()))
              {
                  matchingPolicies = new HashSet<>(initialPolicies);
                  matchingPolicies.add(PolicyChecker.ANY_POLICY);
              } else {
                  // we just return an empty set to make sure that there is
                  // at least a certificate policies extension in the cert
                  matchingPolicies = Collections.<String>emptySet();
              }
          }
          return matchingPolicies;
      }
docs: This method can be used as an optimization to filter out
  certificates that do not have policies which are valid.
  It returns the set of policies (String OIDs) that should exist in
  the certificate policies extension of the certificate that is
  needed by the builder. The logic applied is as follows:
  <p>
  1) If some initial policies have been set *and* policy mappings are
  inhibited, then acceptable certificates are those that include
  the ANY_POLICY OID or with policies that intersect with the
  initial policies.
  2) If no initial policies have been set *or* policy mappings are
  not inhibited then we don't have much to work with. All we know is
  that a certificate must have *some* policy because if it didn't
  have any policy then the policy tree would become null (and validation
  would fail).
  
  @return the Set of policies any of which must exist in a
  cert's certificate policies extension in order for a cert to be selected.