Java applets are largely dead at this point but they do still exist in small corners of the IE world. Signing those jars is paramount and the signature is validated by the browser.
"Java Web Start" still exists and there are at least two programs I use from time to time based on that technology. One being a custom thing, the other openstreetmap editor jOSM.
And Java Webstart jars had to be signed correctly or else the browser would reject the application. As I recall META-INF also had to have the correct security meta data or else the browser would complain.
> Old JDK versions have been kept the same, and Java 7 & 8 are still in heavy use.
But they aren't getting free security updates.
> Not everyone needs enterprise support.
Run it without security patches? That's suicidal for a system like JWS.
Or do you think there's some option that is still support but not specifically enterprise and doesn't cost anything? I would take a look at who historically contributes security patches to OpenJDK and think about if you free vendor really has the expertise you think they do to keep up with security attacks.
