http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/signedJNLP.html#template
states "Elements or attributes that may compromise security will be locked out from this feature."

The above does not explicitly mention that the wildcard notation, *, does not work for properties for example. I suggest to explicitly list all elements and attributes that are locked out from the feature.