--- old/src/java.base/share/conf/security/java.security	Thu Oct 27 00:33:25 2016
+++ new/src/java.base/share/conf/security/java.security	Thu Oct 27 00:33:25 2016
@@ -645,6 +645,8 @@
 # before larger keysize constraints of the same algorithm.  For example:
 # "RSA keySize < 1024 & jdkCA, RSA keySize < 2048".
 #
+# Note: Algorithm restrictions do not apply to trusted certificates.
+#
 # Note: This property is currently used by Oracle's PKIX implementation. It
 # is not guaranteed to be examined and used by other implementations.
 #
@@ -714,6 +716,8 @@
 # See the specification of "jdk.certpath.disabledAlgorithms" for the
 # syntax of the disabled algorithm string.
 #
+# Note: Algorithm restrictions do not apply to trusted certificates.
+#
 # Note: This property is currently used by Oracle's JSSE implementation.
 # It is not guaranteed to be examined and used by other implementations.
 #