JAR signature verification
A way of changing signatures is also needed. We could sign a JAR with the old signature and add another one for future updates, but what about the future updates? We can't bundle every signature…