Currently, verifying a signed JAR only uses a hardcoded of JDK-internal providers. This makes sure a third-party JCA/JCE JAR file does not uses a signature defined inside it to sign itself, and thus avoid an infinite loop. For non JCA/JCE JAR files, this might not be necessary.