This seems to be side effect of JDK-8022730.

Add URL http://stt-13.ru.oracle.com/ to ESL and try URL from JDK-8058955 http://stt-13.ru.oracle.com/newroot/testsuites/180_user_ws/aluht/helloworld/signed_expired_nomf.html

After JDK-8022730 it shows Mixed code warning and even if user choose chooses "don't block" it fails with
java.lang.SecurityException: class "TestApplet" does not match trust level of other classes in the same package

security: resource name "TestApplet.class" in http://stt-13.ru.oracle.com/newroot/testsuites/180_user_ws/aluht/helloworld/ : java.lang.SecurityException: class "TestApplet" does not match trust level of other classes in the same package
basic: exception: class "TestApplet" does not match trust level of other classes in the same package.
java.lang.SecurityException: class "TestApplet" does not match trust level of other classes in the same package
at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(CPCallbackHandler.java:639)
at sun.plugin2.applet.Plugin2ClassLoader.checkResource(Plugin2ClassLoader.java:1005)
at sun.plugin2.applet.Applet2ClassLoader.findClass(Applet2ClassLoader.java:306)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass0(Plugin2ClassLoader.java:294)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Plugin2ClassLoader.java:223)
at sun.plugin2.applet.Plugin2ClassLoader.loadClass(Plugin2ClassLoader.java:198)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Plugin2ClassLoader.java:867)
at sun.plugin2.applet.Plugin2Manager.initAppletAdapter(Plugin2Manager.java:2512)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1625)
at java.lang.Thread.run(Unknown Source)


The problem is that Applet2Manager.wantsAllPerms() in this case returns true for signed jar without permission attribute in the manifest file.