Subsystem should be removed in same way we did it with all legacy subsystems like web, messaging, cmp and others.
This way it would still be possible to manage EAP6.4 hosts with EAP 7.1 domain controller that use picketlink.

PicketLink subsystem was never supported in EAP, it was added in EAP 6.3 but as unsupported feature.
in 6.4 it was also deprecated and marked for removal, as such it stayed also in 7.0.
It was never officially supported in any of EAP releases and it would make sense to remove it in 7.1 as KeyCloak / RH SSO took over as main project/product for single sign on