StartTlsResponseImpl has the following definition:
 
   private SSLSocketFactory getDefaultFactory() throws IOException {
if (defaultFactory != null) {
return defaultFactory;
}

try {
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, null, null); // no client certificate
defaultFactory = (SSLSocketFactory) sslContext.getSocketFactory();

} catch (java.security.NoSuchAlgorithmException e) {

IOException ie = new IOException(e.getMessage());
throw ie;

} catch (java.security.KeyManagementException e) {

IOException ie = new IOException(e.getMessage());
throw ie;
}
return defaultFactory;
}

Is there any reason to do this instead of simply:

if (defaultFactory != null) {
return defaultFactory;
}

return (defaultFactory = (SSLSocketFactory)
SSLSocketFactory.getDefault());

The old way seems to prevent the standard JSSE defaults from kicking in.
For example, the setting of javax.net.ssl.keyStore* properties are ignored.
Ditto for the javax.net.ssl.trustStore* properties. Why not just
use getDefault() and let JSSE take care of initializing the SSLContext
appropriately?