Hi Karsten,
I don't have good answers to your questions. To be honest, when I implemented the Java verification code for #2768, I looked for hints in an old Java version of Tor, rewrote that code, updated it for current BouncyCastle versions using their JavaDocs and examples, and tweaked everything until it finally worked. :)
That's exactly what I'm doing right now :)
I'm cc'ing Nick who would have much better answers to your questions.
Great. Thanks!
Best, Beck