It would be useful to add a build step to optionally sign the native libraries when doing a production (CONF=Release) build, right after the step that strips the native libraries (which was added for JDK-8278260). By adding it at this point of the build, the signed binaries would be available in later steps without, for example, needing to redo the SDK or JMOD zip bundles.