Make api to retrieve the dependencies of a package public, as we use it in a test in another package, swith to the api that will retrieve the cached value instead of re-computing the result
New test to check that message keys are used consistently with package dependencies
this can only be enforced as a warning because it is possible to have constructs such as "if installed, then use message key" that would be tricky to detect