Well, the truststore is in that bucket with the keystore... the CRL does seem kind of associated with those things, IMO.  Moreso than "client auth", I agree with you about that one.

I'm just thinking that since we're using schema to annotate these types, we might as well be thinking about having them encapsulate things that we know we're always going to be passing around together, rather than letting argument lists proliferate.  If the issue was with the fact that the current schema happens to have the word "KeyStore" in the name, we could always change it.

Anyway, I don't really have a problem with it how it is, just bringing this up for food for thought.  Three args to a function is not terribly onerous, but if we end up with any more than that I'd probably start to consider it a smell, especially if we're never passing any of these around independent of the others.