Hi Andre,
I think this option can be removed from java.ini; we can delegate this to the tomcat maintainers: http://tomcat.apache.org/tomcat-3.3-doc/tomcat-security.html.
AFAIK the tomcat debian port already comes with its own security manager.
I'll add an entry to the NEWS file.
Regards,
Jost Boekemeier