alternative JCE providers?

[Peter Schober]

Seems the IDP cannot be run on Free/Libre/Opensource Software alone --
provided stronger crypto is desired/needed for interop -- because of
its use of the Java Crypto API and the export limitations of the
standard implementation thereof?
  This creates the need for the JCE "Unlimited Strength Jurisdiction
Policy Files", which can only be gotten after accepting the "Oracle
Binary Code License Agreement", and cannot even be downloaded from a
console or text terminal, as the website to download the JCE policy
files doesn't even render the download (or "Accept License Agreement")
links in HTML.

>From a quick search it seems that you cannot use a different JCE
provider instead since the policies are applied before the
implementation is even called, or so some claim, and the BouncyCastle
folks also mention the need for the JCE policy files. But I don't
understand their relevant FAQ entry (first on the page, esp. the "Note"
below) at:
http://www.bouncycastle.org/wiki/display/JA1/Frequently+Asked+Questions

Yet others claim using the BouncyCastle Crypo API directly would make
the need for the JCE policy files go away. (Which sounds like a huge
amount of effort for probably very little gain.)

Granted, downloading a zip file from Oracle (and accepting their
binary code license, if you're in a position to do that) isn't all
that much of a big deal, considering the general complexity of
installing and configuring a Shibboleth IDP.

Anyway, I thought I'd ask for any potential alternatives to the current
procedure, esp in light of trying to automate part of the IDP install.
-peter