PKIXValidator has some code which behaves differently if called from Plugin or WebStart (look for VAR_PLUGIN_CODE_SIGNING). We should remove this legacy code which is not relevant anymore.

The following internal APIs are also dead code and no longer necessary:

- DistributionPointFetcher.getCRLs(X509CRLSelector, boolean, PublicKey, String, List<CertStore>, boolean[], Set<TrustAnchor>, Date, String)
- DistributionPointFetcher.getCRLs(X509CRLSelector, boolean, PublicKey, String, List<CertStore>, boolean[], Set<TrustAnchor>, Date)
- OCSP.check(X509Certificate, X509Certificate, URI, X509Certificate, Date)
- OCSP.check(X509Certificate, X509Certificate, URI, X509Certificate, Date, List<Extension>)
- OCSP.check(X509Certificate, X509Certificate, URI, X509Certificate, Date, List<Extension>, String)