Actually it is needed to tell the clients which authentication apps are enabled. We are working on oauth, saml, openid at the moment for example. So the clients has to know how to authenticate against them. This even has to be exposed without login because it is before login. ;-)
I really see your point. But I'm also not sure what concrete security problem we introduce here. The only problem might be if one of the apps has a security problem and we tell the users that it is installed. But then the solution is to fix the security problem and not hiding it from the users. ;-)