I don't remember exactly, but I think I added certifi to runtime because of the download-from-URL style handling. Since this only affected wheel builders, I don't think you'll see whether that's broken from our usual CI.

We shouldn't let our build details leak into user space though. If the issue is just our wheel builders we should fix it there by pre-installing like we do with numpy.

I am very hesitant to do it now (because the space is still moving really fast), but eventually we are going to have to have a look at pep517 and friends....

now this and ##18637 are going to clash, but will deal with that when it happens.

This one should be merged first to make the backport easier.

Actually itis a runtime dependency, e.g.imread("https://matplotlib.org/1.5.0/_static/logo2.png") nowrequires certifi to be present. In fact I think that 1) this should not actually depend on certifi and 2) we should not support directly opening urls anyways...