We don't want to add any dependencies we don't ship.The last several security bugs in ASP .NET Core required us to take no action because they were in ASP .NET Core features we had turned off (and in most cases dyked out at compile time by not referencing the .All package).So I want to reference Microsoft.AspNet.something, and ensure I get an actual NuGet package with actual references in *.deps.json and have the dlls actually appear in publish after dotnet publish so I can pick them up and ship them.