spec of java.security.Provider#merge
https://docs.oracle.com/javase/8/docs/api/java/security/Provider.html#merge-java.lang.Object-java.lang.Object-java.util.function.BiFunction-

It states and i quote
"If a security manager is enabled, its checkSecurityAccess method is called with the strings "putProviderProperty."+name and "removeProviderProperty."+name, where name is the provider name"

Specifically the removeProviderProperty.{name} is mentioned in the spec (please notice the dot between removeProviderProperty and provider name)

But the API method when run with the aforementioned security permissions is failing with the following error ,

Exception in thread "main" java.security.AccessControlException: access denied ("java.security.SecurityPermission" "removeProviderPropertySunJCE")

As you can see above the API expects the format removeProviderProperty{name} instead of the dot inclusive format specified by the spec

Attached the ready-to-run test case for your perusal.

This is found while working on the task : https://bugs.openjdk.java.net/browse/JCK-7301718 which is currently under development.