You have told Composer to download the latest tagged version of "phpseclib/phpseclib" that matches "0.3.x".
First - there is no version tagged since they added "System": "phpseclib/"
so Composer isn't downloading it. You should set the required version to be dev-master
if you want to get the absolutely latest version.
Second - I don't think 0.3.x
isn't a valid semver version. Did you mean 0.3.*
or the equivalent ~0.3
?