The org.bouncycastle module is not used and is marked private so shouldn't be usable by applications.

Perhaps it was retained for compatibility reasons following the refactoring of bouncycastle use when jgit came in? If so, can we remove it now?