Elytron's IdentityCredentials.verifyEvidence(evidence, hashCharset) is calling PasswordCredential.verify(evidence,hashCharset) without passing a Supplier<Provider[]>which will use the INSTALLED_PROVIDERS

IdentityCredentials should have a verify(Supplier<Provider[]>, evidence, hashCharset)