Many security-related APIs use the Date class, which was introduced in JDK 1.0. It is mutable, and some field values can be counterintuitive. Now that we have the java.time APIs, it would be beneficial to transition to these modern APIs and phase out the old ones.