xmlsec once again being pulled in via osgi