Specifying a permission grant in the Java security file for a
principal using the new KeyStore alias format fails to work if the
KeyStore contains a trusted certificate entry for that alias. The
grant only appears to work if the KeyStore contains a key entry, which
includes a certificate chain and associated private key. The alias
format should work for both key entries and trusted certificate
entries, since the idea is to identify a principal, not to be able to
authenticate as one.