We should look into creating a Custodia provider for this interface: https://docs.oracle.com/javase/7/docs/api/java/security/KeyStore.html this would really make it application opaque. We would be able to demonstrate that applications written against this interface which is standard in JAVA would already be enable without a code change.