In GoogleCredentialsProvider, getCredentials() has 2 JWT with scopes with service account workflows:

• One with ServiceAccountJwtAccessCredentials, which is added at Add opt-in support for JWT tokens gax-java#504. This one predates when ServiceAccountCredentials in auth supports JWT (part 1 and part 2)
• Another one with service account here added in feat: add self signed jwt support gax-java#1420, adopting https://google.aip.dev/auth/4111.

These 2 workflows looks suspicious to me, is there reasons why both are needed?

Separately, our guidance is to use ServiceAccountCredentials with SSJWT whenever possible. (see related issue). Thus if both are to keep, the first one can be updated to use ServiceAccountCredentials.