Hang on, the bits it needs from tomcat9 can be vendored inside dogtag-pki, and dependency for tomcat9-user dropped. But it would still need libtomcat9-java to be available, which AIUI should be fine as Debian is shipping it as well.
Hang on, the bits it needs from tomcat9 can be vendored inside dogtag-pki, and dependency for tomcat9-user dropped. But it would still need libtomcat9-java to be available, which AIUI should be fine as Debian is shipping it as well.