This change breaks users of rsa package who are still on Python 2 and who do not set an upper bound on rsa to be rsa<4.1 (or lower). It also breaks Python 2 users of any other library that depends on rsa with an open upper bound.

A clean way to fix current situation would be to release a new version: (for example 4.3), using the sources of 4.0 (which are still Py2 compatible), and then release the most recent released sources in a follow-up release (4.4), and add a stanza python_requires>=3 or perhaps python_requires>=3.5 (depending on which py3 versions you support).

Note that yanking released versions may cause other breakages (see for example discussion in hamcrest/PyHamcrest#131), so a fix forward would be a cleaner way to address this.