Add some more comments in the PKIX date() and timestamp() methods.

Remove extra newline from debugging output.

src/java.base/share/classes/sun/security/provider/certpath/CertPathConstraintsParameters.java

@@ -103,7 +103,7 @@ public String extendedExceptionMsg() {
     @Override
     public String toString() {
         StringBuilder sb = new StringBuilder("[\n");
-        sb.append("\n  Variant: ").append(variant);
+        sb.append("  Variant: ").append(variant);
         if (anchor != null) {
             sb.append("\n  Anchor: ").append(anchor);
         }

src/java.base/share/classes/sun/security/provider/certpath/PKIX.java

@@ -157,8 +157,13 @@ List<CertStore> certStores() {
         }
         Date date() {
             if (!gotDate) {
-                // use timestamp if checking signed code that is
-                // timestamped, otherwise use date parameter
+                // Use timestamp if checking signed code that is
+                // timestamped, otherwise use date parameter.
+                // Note that TSA server certificates do not use the
+                // timestamp, which means that an expired TSA certificate
+                // is considered a validation failure. This policy means
+                // that signed and timestamped code is valid until the TSA
+                // certificate expires (assuming all other checks are valid).
                 if (timestamp != null &&
                     variant.equals(Validator.VAR_CODE_SIGNING)) {
                     date = timestamp.getTimestamp();
@@ -210,6 +215,9 @@ PKIXParameters getPKIXParameters() {
         String variant() {
             return variant;
         }
+        // The timestamp param is passed as the date param when creating an
+        // AlgorithmChecker. An AlgorithmChecker always uses the timestamp
+        // if specified in order to enforce the denyAfter constraint.
         Date timestamp() {
             // return timestamp date if set, otherwise use date parameter
             if (timestampDate == null) {

src/java.base/share/classes/sun/security/util/JarConstraintsParameters.java

@@ -184,7 +184,7 @@ public String extendedExceptionMsg() {
     @Override
     public String toString() {
         StringBuilder sb = new StringBuilder("[\n");
-        sb.append("\n  Variant: ").append(getVariant());
+        sb.append("  Variant: ").append(getVariant());
         sb.append("\n  Certs Issued by Anchor:");
         for (X509Certificate cert : certsIssuedByAnchor) {
             sb.append("\n    Cert Issuer: ")