Best way seems to use a code signing certificate from a well-known CA. Since well-known CA certificates are already trusted by Client (browser, OS), there is no need for additional maintenance with this setup.
Java Applet & Web Start - Code Signing states that
...Users will be better protected by maintaining up-to-date versions
of the JRE on their systems, combined with requiring code that is
signed by a Trusted Certificate Authority (rather than self-signed or
...self-signing is primarily of value to developer and intranet
applications as it also requires managing the keystore for Java...
When using a certificate from CA, renewal poses no problems, we may just sign with renewed certificate. Trusted timestamping, while adding complexity, allows Clients to validate your signature even after your signature expires, given that it had been valid during signing operation (see Signing code for the long haul).
Certificate revocation is checked using Online Certificate Status Protocol (OCSP) at the Client. For details please see Revocation Checking for Java Applications section here.
Nonetheless, there are many large enterprises who manage an in-house CA, primarily for issuing server certificates. If such an infrastructure is already in place, we may assume that internal CA certificates are already being distrubuted to Clients in one way or another, for Clients to be able to trust the servers. If this is the case, issuing code signing certificates from the same CA may not cause additional administrative overhead.