Use cases and implementations of RSA CRT I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...).

The use of this theorem improves the speed of decryption so, why is it not always applied? What are the disadvantages of this version which would explain that it's not always implemented?
The following potential reasons occur to me why someone might not choose to use the CRT optimization:


The implementor worries about induced faults (but not quite enough to implement the obvious protection against it).  That is, with the CRT optimization, we process the RSA block both mod p and mod q separately, and then combine them.  That means that if the attacker can induce a miscomputation in one of the sides, we'll get the correct answer mod p (say), but not mod q.  This can leak the factorization of the modulus
The CRT optimization requires us to hold the prime factors; perhaps the implementer has restrictions on the amount of memory that can be used for a private key.  Note that it's possible to factor the modulus anyways if you have both the public and private keys, and so security isn't likely to be an issue here.
The implementer doesn't care about performance, and instead values simplicity
The implementer is clueless, and doesn't know about the CRT optimization