mypy fails on fresh installs: joserfc 1.8.0 types OKPKey/ECKey.import_key() as returning Any #1845

joserfc 1.8.0 was published to PyPI at 2026-11-03 10:45 UTC. It changes ECKey.import_key() / OKPKey.import_key() to return Self, and mypy now types the result as Any. adcp pins joserfc>=1.7.5,<2, so a fresh resolve gets 1.8.0, and strict mypy (no-any-return) fails in four places:

src/adcp/signing/publisher_pins.py:38: error: Returning Any from function declared to return "str | None"  [no-any-return]
src/adcp/signing/crypto.py:129: error: Returning Any from function declared to return "OKPKey | ECKey"  [no-any-return]
src/adcp/governance.py:1687: error: Returning Any from function declared to return "OKPKey | ECKey"  [no-any-return]
src/adcp/governance.py:1689: error: Returning Any from function declared to return "OKPKey | ECKey"  [no-any-return]

This failed the Test Python 3.12 type-check job on #1840, a docs-only PR (run 41623407861, and again on rerun). I reproduced it locally with joserfc==1.8.0; with 1.7.7 mypy is clean. Runtime behaviour is unaffected.

Fix: bind each import_key() result to an annotated local before returning it. cast() would be flagged as redundant under 1.7.x, because strict = true enables warn_redundant_casts.

🤖 Generated with Claude Code