update certificate in vendored JARs
add code-signing instructions to README because i only deal with this enterprise idiocy once a year