Apparently Spongy Castle is the Android alternative to using a full version of Bouncy Castle.
However, on importing the jar I'm getting all kinds of "cannot be resolved" errors because it relies on packages not included with Android, primarily javax.mail, javax.activation, and javax.awt.datatransfer.
So what's the best way around this? Responses to this question and this indicate those packages shouldn't be used at all, and this popular question doesn't even consider finding a way to get AWT back. So how is Spongy Castle relying on them? People are using Spongy Castle, right?
These are two very simple examples of how to include Spongy Castle in a project:
Since v1.47, Spongy Castle has been split into separate sub-jars that exactly mirror the matching Bouncy Castle artifacts (eg sc-light-jdk15on.jar, scpg-jdk15on.jar, etc), and it is important to ensure you include all the Spongy Castle jars required for what you're doing.
Full information on dependencies can be found at:
http://rtyley.github.com/spongycastle/#downloads
At minimum you'll need the sc-light-jdk15on.jar (the base lightweight-API implementation) and probably scprov-jdk15on.jar (the JCE wrapper around the lightweight-API). If you're using Maven then all this dependency-management stuff is taken care of for you.
The problematic dependencies you describe on javax.mail, javax.activation, etc, indicate that you might have chosen an incorrect jar (e.g. the every-single-library-component one, rather than the 'core provider' one) - as the scprov-jdk15on jar definitely doesn't have any of those weird dependencies, and runs happily on Android.
(disclaimer, I'm the maintainer of Spongy Castle, but I've had plenty of success reports from other users too!)