This is a great question! The answer is twofold: 1. Compatibility: PyCA Cryptography has strict compatibility requirements, including being able to build with

This is a great question! The answer is twofold: 1. Compatibility: PyCA Cryptography has strict compatibility requirements, including being able to build with older versions of Rust that crates like webpki and rustls-webpki may not be interested in supporting. 2. Generality: PyCA Cryptography is a general purpose cryptographic toolbox, and the plan for X.509 validation is not intrinsically linked to just the Web PKI profiles. In the future, they may wish to make their APIs more flexible than a strictly CABF validator would require, meaning that they would either need to carry patches against `webpki` or get such flexibility upstreamed (to the detriment of the crate's single purpose). (I am not a maintainer of Cryptography; this is my understanding of the reasons as one of the implementors of this feature.)