I just noticed that when i use --ask-deps and select as explicit
dependency only one single patch, what I actually get is a large number
of explicit dependencies in addition to the one I selected. This can be
seen with log -v and also in the on-disk representation of the patch.

Is this a bug? Or do I misunderstand how explicit dependencies are
supposed to work?

This particular issue was fixed, but the fix is unsatisfactory. What we do 
now is that we filter out (all) indirect dependencies /after/ patch 
selection. This means that when you say 'l' ("list") during selection, you'll 
see all those automatically selected patches, but they won't be actually 
added to the patch we record; we add only those which we do not already 
(recursively) depend on, thus minimizing the set.

The underlying problem is that --ask-deps uses the standard patch selection 
mechanism, which requires that the chosen set is an initial or final segment 
of the eligible candidates. There is no valid reason why selecting explicit 
dependencies should be constrained in this way.