The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass