As we can read in many other questions here Connected Apps used by and used in combination with a Managed Package actually don't need to be created in the customer org (e.g. by using Metadata API) OR go as metadata into the Managed package (would make it super hard to create multiple dev orgs).
I need the Connected App so external Java Application at dynamic endpoints needs to connect to my Managed Package and modify data using the Standard REST-API.
And the App needs to pass Security Review. So it somewhat needs to conform to official Salesforce recommendations.
Then where do I create the connected App and how do I reference it in the Managed package? Or is this even the wrong question?