"Critical" projects and volunteer maintainers

Minor point of clarification on the lockfile situation... the "openstackci" account on PyPI is a maintainer of that project because the account was used to upload some new releases of lockfile in the 2014-2015 timeframe, when OpenStack briefly took on maintenance of it in order to address some bugs and ease their transition away from depending on it longer term.

The current transitive dependency OpenStack has on lockfile (because of the Ansible project's ansible-runner dependency chain) is really only for a fairly small corner of the hundreds of individual projects which make up OpenStack, so PyPI's download count for lockfile is probably not primarily due to OpenStack's automated testing and more likely due to the general popularity of the python-daemon project (which depends on lockfile). Further, the OpenStack community's CI relies heavily on local caches and mirrors, so doesn't actually pull directly from PyPI very often.