A JAD file is just a text file. If you're downloading by HTTP, point the browser at a script (perl, php, whatever) instead of a JAD file. For example:
It is essential that you set the content-type correctly, so that the device's browser will recognize the stream as a JAD.
my $time = time;
Content-type: text/vnd.sun.j2me.app-descriptor; charset=UTF-8
MIDlet-1: MyApplication, /res/icon.png, MainClass
Signing is not a problem, since the signature protects only the JAR, not the JAD. The JAD can be changed without invalidating the signature. However: for signed applications, any attribute that appears in both the JAD and the MANIFEST (in the JAR) must have the same value. The JAD is not permitted to "override" a MANIFEST value (whereas it can for unsigned apps).