Like a number of other classes in the crypto framework, SecretKeyFactory is supposed to perform a failover to another provider in case the preferred provider does not work or does not support the provided inputs. Code to do that was added in Tiger by 4894125. However, that fix was incomplete and failover in SecretKeyFactory has never worked.