if I remember correctly, a package can also become a key package by having a
high-enough popcon value. If that is correct, maybe there should also be the
inverse. Looking at your list, about 85% of those packages have a popcon lower
than 100. Taking the popcon value into account would also kinda make your
hand-curated list of exceptions obsolete as your current list has popcons well
above 100, for example. If the popcon is taken into consideration, that would
also give a little bit of insurance that only very few users will be affected.