A signed JAR is a Java archive whose contents are associated with a digital signature. Java can use that signature to check whether the archive has changed since it was signed and to identify the signing certificate. A valid signature supports integrity and attribution; it does not prove that the code is safe.
Signatures depend on certificate trust. If a certificate or an intermediate certificate authority in its chain is distrusted, Java may reject the JAR or report that its signer cannot be trusted, even if the archive has not been altered. Attackers may also distribute modified or malicious code in unsigned archives or misuse stolen signing keys. Defenders should verify JAR signatures, keep Java runtimes and trust stores current, protect code-signing keys, and test certificate-policy changes against applications that rely on signed JARs.