My grepping for non-optional module dependencies on org.picketbox reveals these:
Let's figure out how to make these optional, or eliminated.
I believe the messaging-activemq extension one can be optional just by adding a capability reference config to the security-domain AttributeDefinition (the absence of which is a bug). The extension does not use classes from picketbox unless that attribute is configured, so the capability ref will effectively guard that use.
I'm not sure about the artemis deps. I don't see uses in my checkout of https://github.com/apache/activemq-artemis, so perhaps if that dep is needed to handle unusual classloading situations, those situations would not occur if the 'security-domain' attribute isn't set, and the dep would thus be optional.