... but if I take the `:jar-exclusions` line from above out, I do get the `CertificateAuthority.java` file in the `*-sources.jar`.  Wonder if it has a global effect for all jars?