Certainly true, but the keystore also stores a chain of certificates for
each key entry, that would excellently fit in a
java.security.cert.CertPath object.  ;-)

I am currently trying to implement something like an efficient (fast)
PKI. Within that, I need CertPaths to store verfied certificate paths
immutably. I have not figured out yet how to convert an array of
X509Certificates into a CertPath in an elegant way. Of course it works
somehow like

    X509Certificate[] certChain;
    Vector certVector = new Vector();
    for (int i=0; i< certChain.length; ++i) {
        certVector.add(certChain[i]);
    }
    try {
        CertificateFactory certFactory =
            CertificateFactory.getInstance("X509");
        CertPath certPath =
            certFactory.generateCertPath(certVector);
    } catch a million exceptions...

The array to list conversion is quite annoying. You cannot extend
CertificateFactory to add a method accepting an array of certificates
because it is final and you cannot implement your own
CertificateFactorySpi without a certificate from Sun. The policy is Sun
doesn't want you to add methods to the API. Alright from a security
perspective. But OTOH the API is incomplete. You have the choice: Work
around the design flaws and ruin your clean design or build your own API.

And I didn't even start to tell you about incomaptibilities between
BouncyCastle's and Sun's X509Names, where you have to reverse the list
of attributes in the DNs...

Decoupling is OK, but it should be easier to plug them together if you
want to. I am just fed up of writing adapter classes.

JK.