We have a disconnect between the version we advertize and package as an extension (1.69) and version packaged in features (1.66).
There is another problem, which is actually underlying the failures. With version 1.69, as noted:
Some work has been done on moving out code that does not need to be in the provider jar. This has reduced the size of the provider jar and should also make it easier for developers to patch the classes involved as they no longer need to be signed. bcpkix and bctls are both dependent on the new bcutil jar.
Hence we need to adjust our packaging to cope with that.
Finally, Karaf itself is referencing BouncyCastle, hence we end up with duplicate packaging (again).