...
A workaround that *appears* to fix the issue (I haven't done serious testing) to fix the issue is to wrap a file input stream in an org.apache.velocity.io.UnicodeInputStream instance, which is specifically designed to be BOM-aware. (There is also a BOMInputStream in apache.commons.io, but in a later version of the jar than is included in Openmrs 1.6).