Yeah, I find this really annoying too. Java has all the right integration to windows trust store and you can write custom code to use it. But it’s not sued be default.

This makes using internal CAs a nightmare.

> Every system capable of running Java also has its own trust store

No, they don't: https://en.wikipedia.org/wiki/Java_Card

there are also other examples of java running in embedded and semi-embedded scenarios where a TZDB and a SSL trust store would not be guaranteed by the host.

Even if that is true now, it certainly wasn't always true. When did Java add its trust store, and when did Windows and Debian and Solaris?

There's also a consistency issue --- write once, run everywhere doesn't work if you need to resign your webstart program based on the OS you're running on.

Not sure about that, the Windows certificate store has been around since forever, perhaps even since Windows NT. The same goes for certificate management in Linux. I think it was mostly because it was far easier for the Java team to roll their own extendable store instead of doing all the platform integration themselves.