Core has a dependency on bouncycastle that AFAICT is not used. It was brought into core when a class from full's testsuite/shared was ported, but the core usage of the class has no need for the bouncycastle-related logic.

Full eap also has a dependency on bouncycastle in its pom, but the versions between core and full have gotten out of sync. Cleaning this out of core will prevent that problem from recurring.