while it's true that any iterable of strings will work at runtime, the docstrings say that a file-like object is expected, and IO[str] does express that it should be an iterable of lines (rather than an iterable of words or characters).

I know you're generally opposed to using IO, though, and I share your philosophy there... not sure if there's a protocol that could also express "this needs to be an iterable of lines of source code" in the same way...

Well, Iterable[str] is explicitly named for situations like this by the Python docs, but then that section was also written be me IIRC, so make of it what you will.

That said, maybe for now we could add a type alias to _typeshed and at some point this might become something more.

pynacl looks to be fully typed and has a py.typed file. We could consider adding it to the stub_uploader allowlist and then adding it as a dependency of these stubs.

I've just confirmed that paramiko depends on pynacl so that is viable, and probably wouldn't have much of a negative impact in practice. That said, considering that this looks to be the only place where the stubs pynacl and this is more of an internal module, an optional dependency like I suggested #15549 would be a better fit here, in my opinion.