Okay, I can answer my own question:
It is a known and documented bug that jce1.2.1 SealedObjects don\'t work properly if you install the jce as an \"installed\" extension. So don\'t try.
It is a known (but not documented: search for the \"cannot issue certs to trusted ca\" exception message) bug that Diffie-Hellman key exchange doesn\'t work with jce1.2.1 and anything earlier than java1.3. The sample code won\'t even work. This is a pretty serious problem, I wish I had saved an earlier jce version!
Will MacOS X final include java1.3?