If you are sure nobody else is implementing that interface, I'd be happy to do that. I'd also like to set the default verification level to VerificationLevel.HEADER.
To be honest, I think the whole concept of token retrieval strategies is a poor over-design that apparently isn't flexible enough anyway (first time I need to add something, I have to change the interface). It lowers usability and isn't even working properly - note I can set one host to retrieve SST from (in the login retrieval strategy) but the TT would still be retrieved from the request host :( - my last commit should fix that. So, I'd love to deprecate the whole thing and just have either login/password or sst set on the client itself.