We have a disconnect between the version we advertize and package as an extension (1.69) and version packaged in features (1.66).

There is another problem, which is actually underlying the failures. With version 1.69, as noted:

Some work has been done on moving out code that does not need to be 
in the provider jar. This has reduced the size of the provider jar and 
should also make it easier for developers to patch the classes involved 
as they no longer need to be signed. bcpkix and bctls are both dependent
 on the new bcutil jar.

Hence we need to adjust our packaging to cope with that.

Finally, Karaf itself is referencing BouncyCastle, hence we end up with duplicate packaging (again).