Create policy so that future email attestations are secure

[AW-STJ]

Since Devcon required the users not to receive individual verification OTPs, there are 2 solutions

1. Since most users use gmail, we can use 0auth by attestation.id
2. Or we can make a special policy so that email attestations are used as OTP but for DEVCON only.

This email is about the latter.