The content in a JAR file might be different depending on if it's loaded with `JarFile` or `JarInputStream`. While the `jarsigner -verify` command should continue to use `JarFile` to verify the signature, it will be nice if it can also try again with `JarInputStream`. If there is any difference, a warning will be welcome. When the `-verbose` option is provided, it can tell the difference of each JAR entry.