We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA roots as well in any JVM updates? Was there any indication of such move?
Oracle page https://java.com/en/jre-jdk-cryptoroadmap.html mention only TLS server certificates being distrusted. Does this mean that JARs signed by certificates rooted in one of the affected CAs are still OK to be used?