The Shibboleth IdP v4 will set the default encryption to be GCM instead of CBC. See

https://wiki.shibboleth.net/confluence/display/IDP4/GCMEncryption

pysaml2 needs to support GCM so that SAML SPs built using pysaml2 can consume and decrypt assertions sent by the Shib IdP v4 that are encrypted using GCM.