I'm sure on the CredentialMetaData component, but not necessarily the one simple implementation I provided out of the box. I think your concern is valid, but I'm reluctant to spend too much energy on defining required types of metadata when the use requirements for MFA are so poorly defined. That said, if we do the Credentials refactoring you mentioned elsewhere, then most Credentials implementations would implement _both_ Credentials and CredentialMetaData, so you could simply use the Credentials classes directly. The one notable exception would be UsernamePasswordCredentials since it contains sensitive data. In any case I think we can address these concerns in a subsequent refactoring of Credentials.