Why are you treating `$credentialTreatment` and `$credentialValidationCallback` as mutually exclusive? Could we not have both? If not, why not?