That said, Java applets are effectively dead, so government services now require installing and running separate program which listens at localhost for connections from browser. Honestly, it doesn't look like a big win for me, more like a big loose, from a security point. But here we go.
This sounds crazy smart. Why don't western countries do this? You could even put the fingerprint in the barcode of your driver's license.
Having said that, a better implementation would be pretty awesome.
And, yes, those certificates are unrelated, AFAIK.
In a past life, I had to keep two different browser installs, each with a different JVM version in obsolete browsers, aside from my "real" browser to deal with crap like that.
I've been through multiple attempts at doing it in an enterprise, one in January this year, and it always ends with the determination that Java applets are critical to websites used by the business and not going anywhere. Healthcare portals are a big offender.
It's a total nightmare because most of it is abandonware or is still for sale but unmaintained!