Applets and PKI certs

I have an applet in my system and we have to begin requiring client-side
PKI certs.  From the testing that I have done, this requires that certs
for the user, the server and the signing organization be installed in
the JVM(keystore) on each workstation.  Recent versions of Java do not
use the certs installed in the browser - they must be in the keystore
inthe JVM.

Has anyone come up with an easy way to distribute and maintain these
certs to accomodate using applets?  Visiting every worksatation is a bit
of a burden.

Any ideas would be appreciated.

Thanks
Chuck

take a look at openoces.org
there is a signing applet using pkcs12 certificate.

-Michael