This method is a bit hard to read. I'd think we could rewrite this to convey intentions better. Perhaps resolve the given credential outside the loop first?