When -providerClass is specified with keytool, it will only try to load keystores that's supported by this security provider. However, in keytool.html, we have --

  -providerClass <provider_class_name>
      Used to specify the name of cryptographic service provider's master class file when the service provider is not listed in the security properties file.

which means the option is not only for storetype, but for all kinds of algorithms.

This bug prevents generating/saving keypairs from a non-"java.security" provider into a JKS keystore. For example, the newly supported NSS EC.