...

With good reason.

Sign the code, then convince the visitor to
accept the digitally signed code that can
eavesdrop on them.

As an aside.  
What does this code *offer* to the end user?

If I were your end-user, what compelling
'must have' ability does it offer that would
convince me to allow you to eavesdrop
on the sounds going through my PC?

Note that I *have* actually asked users to
trust code that allows my web start app. to
'listen in' to the system sound - but the reason
I offer is quite cute (though trivial) and compelling.
The software offers a pretty visual trace of the
sound, an oscilloscope*.  

Of course, the average end user** has to trust that
the code is not doing anything more than displaying
the sound back to them - if they do not trust me, the
'game is over' before the app. ever launches.

* <http://www.physci.org/sound/audiotrace.html>

** A web savvy and experienced Java developer
could check and confirm it.

Hopefully not.

Just signing.  It is not that difficult. You can even use a phony
certificate.  see http://mindprod.com/jgloss/signedapplets.html