It seems cleaner to change #addPrincipals(credentials, principals) to:
<code>
private Set<Principal> collectPrincipals(final Credentials credentials) {...}
</code>