Hi Jeff,
There is a permission called "switch policy" that allows a user to remove security as well. In APS 7, this permission does not show up in the Web Interface for users other than the publisher. It is possible, however, to create or modify the policy using the SDK to give other users this permission.
BTW, in the 8.0 release, we have a much better solution. There is a new feature called "Policy Sets" that provides delegated administration for a group of policies and the documents secured with those policies.
Hope this helps,
-Bill