Worth reducing the number of dependencies?

First, thanks for building keyring!

Would it be possible to reduce the number of dependencies in any way?

We are in a weird situation where we would consider `keyring` to improve the security of a system by using the OS keychain, but at the same time, installing `keyring` means installing 9 additional dependencies, which increases the attack surface. (And potentially also increases the start-up time and could result in a conflict of indirect dependencies.)

So, a few questions:
- Why depend on `jaraco-classes` if the relevant code is already copied over in `keyring/copat/properties.py`?
- From `jaraco.functools` we only use `once`. Could we copy this over in the same way `properties.py` is copied? And the same for `ExceptionTrap` and `suppress` from `jaraco.context`?
- Both `jaraco-classes` and `jaraco-functools` depend on `more-itertools`. But in the end `more-itertools` is not used at all. (unless I miss something). Having a dependency installed that is not used at all doesn't sound great for a security related package.
- Less problematic, but given that I'd prefer not to load plug-ins, a dependency on `importlib_metadata` would also not be needed.

What do you think? Are these valid concerns that could be addressed to some point? Would you accept contributions? Or would it be better to fork the project in this case, or look for an alternative?

Start with keyring/copat/properties.py and the listed jaraco and importlib_metadata dependencies, then trace their usage and dependency declarations. Review how the project’s tests cover keychain and plug-in behavior before evaluating changes. Done means an agreed reduction in installed dependencies without breaking supported functionality.

Written by the indexing model from the issue text.