Drop the EvidenceDecoder as it is only used by SecurityDomainTrustManager.

Instead Evidence will have a getPrincipal method which will by default return null, when verifyEvidence is called this can be used to set the current principal / trigger name rewriters / principal decoders etc... Then verifyEvidence can call itself / continue.

Where no Principal is returned the current iterate the realms approach can be used.