It turns out we were relying on dateutil being pulled in transitively by pysaml2. There's no need for that bloat.
Richard van der Hoff