A little fox crosses a stream in China. If he goes a little too boldly and confidently — unlike a wiser older fox — he is likely to get wet. At the very end of his crossing, his over-confidence reaches its peak, he feels his feet on dry ground, he relaxes his vigilance and his tail drops into the water.
~ I Ching

The Catches

1. You must modify your HTTP server to deliver jars in three flavours, *.jar, *.jar.gz and *.jar.pack.gz based on generic *.jar requests. You must prepare and upload all three flavours of jar.
2. Pack200.exe and Unpack200.exe are native utilities, not java classes. You must do all your handling of such jars via external exec of these JRE command line utilities.
3. Signed jars that have been packed with pack200.exe cannot be verified until they have been unpacked with unpack.exe.
4. Pack200.exe is specialised for class files. If your jar is mainly resources, you are better off to create a jar of stored (uncompressed) entries, then compress the whole thing with GZIP. This works considerably better than GZIPping a file of already compressed entries. Then you will have a *.jar.gz extension and gzip content encoding. It will have have to be unzipped at the other end, and there it will sit on disk in completely uncompressed form.
5. Packed files don’t have a simple unique extension, thus they can’t be easily handled by the extension to MIME tables in an HTTP server. They require custom coding.