I've looked for issues regarding this and I couldn't find one, I apologize if there is one already. When creating a conduit bundle that references signed jars the build process ends up stripping the signature off of it.

I've done some debugging and I believe the problem comes from this section of the code where the Jar instances are being created but the doNotTouchManifest attribute is not being set to true. This results in this execution flow that modifies the manifest and in the process strips the signatures.

(Maybe unrelated/irrelevant) I've also noticed there's an unused private attribute in the Jar class called nomanifest.