The com.sun.jarsigner APIs should have an @jdk.Exported annotation. They have always been considered to be supported JDK APIs. We missed adding this annotation in JDK 8 as part of JEP-179.
This will require a CCC. This will also require a change to the jdk.dev module to export the com.sun.jarsigner package.