An HSS private key now claims its top-level index and its bottom component key's one-time index under the one monitor rather than two, the LMS tree cache is accepted only at the node counts its consistency check actually covers, a single-level HSS wrap keeps the key it was given instead of regenerating the whole Merkle tree, the LMS and HSS signers and the BcHssLmsContentSignerBuilder accept a key wrapped in ParametersWithRandom, LMS verification applies the typecode and leaf-number checks of RFC 8554 sec. 5.4.2 steps 2g and 2i, the key parameter constructors and decoders apply the checks the encoding requires, and the LMS JCE layer gains the twelve missing LM-OTS parameter-set names.