8180289: jarsigner treats timestamped signed jar invalid after the signer cert expires

Reviewed-by: mullan

src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java

@@ -724,7 +724,8 @@ public class SignatureFileVerifier {
             if (signers == null) {
                 signers = new ArrayList<>();
             }
-            // Append the new code signer
+            // Append the new code signer. If timestamp is invalid, this
+            // jar will be treated as unsigned.
             signers.add(new CodeSigner(certChain, info.getTimestamp()));
 
             if (debug != null) {