> given that we created now so many helper classes in this PR already I wonder why this is still an inner class? Would it not make sense to make this a proper class.

+1 I'll change that, this seems indeed better.

> Also, do we need the privileged action?

We do, since `Class#getClassLoader()` is used. But I guess I could make a method for this on `SecurityActions` and then implement the rest from `GetValidationProvidersAction` in the provider class. This seems like a better design.