We do not have any limitations on how an SSO connects to the vendor. You should be able to execute the method required by the vendor.
There are many python libraries that should help with the EncryptedAssertion.
The way I did it was since the extension already uses lxml and xmlsec in the saml_response.py, I just used lxml to make the EncryptedAssertion node, I used xmlsec to encrypt the Assertion node into an EncryptedData node and then lxml to move the EncryptedData node into the EncryptedAssertion node.
A note though that the vendor I was working with only needed the Assertion node encrypted.
Thanks to Justin Miller's response, I was able to extend the SAML extension to sign and encrypt the assertion using the lxml and xmlsec libraries. It would be nice to have these options available directly from the SDK. It does not take a lot of code but you do have to understand exactly what is required by the Service Provider.
—