When representing this information at runtime we can not be sure that we can obtain the actual entries from the KeyStore as they may be password protected, all we can do is check the entry type.

I think it would be fair to say an enabled account and a disabled account are two different entry types, the disabled type could even also prevent access to the password to prevent it's accidental use in a realm.