Depends on D8318. All providers must support this, or they can't be implemented securely. This is based on a very old reading of the GitHub instructions or something like that which didn't mention "state", but the provider supports it.

This has no impact at runtime because no provider has ever returned false from this method, nor would we ever implement a provider that did.

Grepped for callsites.