How does JWS react to code signing certificate expiration?
From my observation it appears to ignore expiration date of CA-signed certificates, but I would like to find some hard proof (e.g. official documentation) that confirms this.
If the signed jar is given a timestamp (which comes from a timestamp authority), then the signature will still be valid even after the certificate has expired (assuming the timestamp is prior to the expiry).