I have to implement a "PinSignInAsync" method on my SignInManager. This will basically be (almost) exactly like the PasswordSignInAsync" method, but will be calling a new "UserManager.CheckPinAsync" method and does not have to deal with TwoFactor code.

To implement this I looked at the existing password method, and there are 4 private methods that it uses. If these were protected, then I could use them in my own derived class so code is reused and not duplicated.

    private async Task<bool> IsLockedOut(TUser user)
    private async Task<SignInResult> LockedOut(TUser user)
    private async Task<SignInResult> PreSignInCheck(TUser user)
    private Task ResetLockout(TUser user)

I would also suggest reviewing the other private and internal methods/classes to see if the would benefit from being protected/protected internal.