This is very big and will affect a lot of java projects, JCenter is one of the most important central repositories currently available, specially because of bintray since publishing to actual maven central was quite a lot harder than bintray.
Removing jcenter as a source in the buildscript is a trivial step but doesn't remedy the issue as the dependencies are not all mirrored elsewhere.
Complexities of setting up a Maven central account is often listed as the main cause for maintainers simply going for JCenter instead.
Plenty of them, since it's just adding a few lines to either pom.xml or the Gradle script. Sure, maybe there's rules against it in your org, but if it works then a code reviewer might say whatever, there's bigger problems
You have to file an issue on a JIRA board.
Provide proof of owning a namespace(dns txt record, or github).
Wait for a human to review and approve the ticket.
Create a PGP key.
Publish the PGP key to public key servers.
Submit your builds via the webapp.
Wait for the verification process to complete.
Have it fail a bunch of times randomly, because despite uploading your PGP key to as many of the keyservers as you could, there seems to be a huge key replication delay between keyserver instances, and the verification process can't find the key published.
Once verified, actually publish the build.
Most of the pain is one off, once you have gone though it, publishing new builds can be automated.
The PGP signing is pointless, you can sign with any key you like, and change the key as often as you like, just so long as the key is published. 10 years in the industry, I have never heard of anyone checking the signatures on maven artifacts.
I check them on every build, with the pgpverify maven plugin: https://github.com/m50d/tierney/blob/master/free/keys.proper... . Presumably I'm not the only one since that plugin exists.