Architecting Robust BGP Routing Policies