It appears now that webstart fails to verify that signed .zip files are in fact signed (.jars have been fine for me).
This happened to me while granting all-permissions, perhaps true more generally.
Solution: rename the .zip to .jar for the moment, but .zip worked fine in previous versions so perhaps this is a bug.
ChuckBing made a lot of sense - search for/lodge a bug
(I just thought I'd mention that, before I forget).
As part of the process of doing that though, a
'test case' might also be useful.
http://www.physci.org/test/jws/zip/
This directory contains links to an altered
version of a project I developed that displays
an audio trace. To 'eavesdrop' on the sound,
it requires all-permissions.
This version is altered from the original, in
that it requests 1.6 specifically, and the .jar
has been renamed to a .zip.
Here is the result..
http://www.physci.org/test/jws/zip/zipsign.png
(it confirms the OP's initial claim, though I
do not yet have a test that definitively proves
that it worked in 1.5 - I usually use .jar files,
except for resources..)
Note, also mentioned here, asking for
further test results..
http://groups.google.com/group/comp.lang.java.programmer/browse_frm/thread/c9937f36464273ff