Looking internally, it looks as if this was done explicitly as part of GRANITE-20756 which addressed some technical debt around API leakages. Essentially it was done for a security reason."We will have to try and directly include org.apache.santuario/xmlsec in the quickstart, instead of embedding it...