My grepping for non-optional module dependencies on org.picketbox reveals these:

ee-9/feature-pack/src/main/resources/modules/system/layers/base/org/apache/activemq/artemis/main/module.xml:        <module name="org.picketbox"/>
ee-feature-pack/common/src/main/resources/modules/system/layers/base/org/wildfly/extension/messaging-activemq/main/module.xml:        <module name="org.picketbox"/>
ee-feature-pack/common/src/main/resources/modules/system/layers/base/org/apache/activemq/artemis/main/module.xml:        <module name="org.picketbox"/>

Let's figure out how to make these optional, or eliminated.

I believe the messaging-activemq extension one can be optional just by adding a capability reference config to the security-domain AttributeDefinition (the absence of which is a bug). The extension does not use classes from picketbox unless that attribute is configured, so the capability ref will effectively guard that use.

I'm not sure about the artemis deps. I don't see uses in my checkout of https://github.com/apache/activemq-artemis, so perhaps if that dep is needed to handle unusual classloading situations, those situations would not occur if the 'security-domain' attribute isn't set, and the dep would thus be optional.