Jakarta Security is the only one that seems consistent between groupId and package name.
I think you should start by getting agreement from the Committers to that project.
I personally don't have a problem with them changing names to be more consistent.
I recently noticed, that renaming some specs like JASPIC to another Jakarta name had a side-effect of a mismatch and inconsistency of the Maven GroupIds.
While Jakarta Autorization (https://github.com/eclipse-ee4j/authorization) ended up with:
Its sibling Jakarta Authorization (https://github.com/eclipse-ee4j/authentication) sticks with a GroupId root already known by Jakarta Security:
Was there a reason to abandon the "jakarta.security" prefix for one, but keep it for the other?
Also IMO "jakarta.security.auth.message" is wrong on so many levels, to start with it confuses people with Jakarta Messaging because the word "message" and the acronym "auth" tells nothing whether it is "authorization" or "authentication".
Since they were both recently changed from the "javax" namespace, I doubt either of them are "given by God" now, so could we at least harmonize them, either with the "jakarta.security" prefix or without?
jakarta.ee-spec.committee mailing list
To change your delivery options, retrieve your password, or unsubscribe from this list, visit