It now makes sense for key CFClient to be protected, too