Background on why I raise this: for Common Criteria certification we have to defend all public static methods. Either document how they are harmless, ensure they aren't visible to outside callers via a filter in module.xml, or require a security manager permission (and document that.) So I want to avoid them. :)