Hi, Please review the update: http://cr.openjdk.java.net/~xuelei/8207029/webrev.00/
It's an interesting user case of the TrustManagerFactory and KeyManagerFactory. The KeyManager or TrustManager implementation may be not implemented in the same provider as SSLSocket/SSLEngine.
See also http://mail.openjdk.java.net/pipermail/security-dev/2018-July/017536.html.
Thanks, Xuelei