Interesting but unconvincing theory. I have never seen public API documentation that lists private fields before. This certainly makes no mention of private fields: http://www.docjar.com/docs/api/sun/security/provider/certpat...