I think this is feasible but I'd like to constrain it to another pull request since it's large in scope and there's some other credential-related cleanup/consolidation I'd like to do.