There doesn't seem to be any reason for the API in this module to be loaded by the boot loader. Also as nothing in the JDK depends on it then it should be straight-forward to move. It could initially move with AllPermission but would be better to identify the permissions that it required so that it is granted the minimum permissions that it needs.