Add instructions on how to swap out the certificate used to sign OIE builds

[kpalang]

A guide should be written on how to change the certificate that's used to sign OIE builds. The keystore.jks can be found here and credentials here.

[mgaffigan]

@kpalang, can you help me understand the benefit of signed builds in a world without jws? For authenticity, it seems that checking the file hashes against official releases would be sufficient.

[kpalang]

@mgaffigan
Currently, the main purpose would be to maintain usability with Mirth Connect Administrator Launcher, which requires client-side jars to be signed.
The other, less important purpose is to just verify the origin of the files. But you are also correct saying that validating file hashes would also be fine.

[mgaffigan]

Is MCAL checking against PKI? Or just checking that they are signed? (In other words: is an ephemeral certificate sufficient?)

[kpalang]

Yes, MCAL requires clientside jars to be signed with a cert from an actual trusted CA, or one or two of their hardcoded CAs. There is the option of running MCAL with -k, but that should only be used in development and is also inconvenient as MCAL nags about the cert on every launch.

So I think a proper cert is required for as long as compatibility with MCA is desired.