pyca/cryptography was an indirect dependency of Gentoo's package manager, Portage. Portage is written in Python. So by definition, there were users. "was", bec

pyca/cryptography was an indirect dependency of Gentoo's package manager, Portage. Portage is written in Python. So by definition, there were users. "was", because after this incident, careful review revealed that it isn't necessary, and dependency got removed. So yes, probably no users now.