Using the JarFile class I can verify that a jar file has been signed. But, based on my reading of the API docs and the jarsigner docs, I do not see a way to verify the signer. In other words, I can verify that the jar has not been modified since it was signed, but it seems that it could have been signed by anyone using any key.

Wouldn't verification pass if an attacker modified the jar and then signed it with his own key?

This seems like a fundamental principle to exclude from the documentation - so I suspect I am missing some background knowledge somewhere. What am I missing?