It was reported that OGSi based application fails to load a keystore with the exception thrown:
java.io.IOException: Invalid secret key format
       at com.sun.crypto.provider.JceKeyStore.engineLoad(JceKeyStore.java:861)
       at java.security.KeyStore.load(KeyStore.java:1357)
....

This appears to be due to the change of the way a classloader for serialization is chosen (see the bug JDK-8155977 for details).
As a result, when a keystore was loaded from a OGSi bundle, the org.eclipse.osgi.internal.baseadaptor.DefaultClassLoader was chosen, which failed to load the class SealedObjectForKeyProtector (an instance of which was stored in the keystore).

The workaround is to instruct DefaultClassLoader to delegate classloading to ExtensionClassLoader:

1) edit the bundle's META-INF/MANIFEST.MF
2) add the line to it:
Eclipse-BuddyPolicy: ext