On reading the DER encoding of an ASN.1 BIT STRING whose length is not a
multiple of 8, DerInputBuffer.getBitString() returns null.

Non byte-aligned bitstrings occur in Verisign certificates used in Netscape signed jar signatures, so this presents an interoperability problem. In particular, non byte-aligned bitstrings are used in the KeyUsage extended attribute.