The functionality is more a part of the provider than the context so it should be defined in it. It also doesn't use any parts of the SSLContext which makes it somewhat more clear that it doesn't belong there.