The modules ipaclient.csrgen and ipaclient.csrgen_ffi are expensive to load but rarely used. The modules pull in about 70 additional modules, including very expensive modules like jinja2. ipaclient.csrgen_ffi also uses find_library to locate libcrypto and creates a FFI object (see ticket #6851). On my test system, both modules slow down ipa command by about 200ms or more than 20%

# time python3 -c "import ipaclient.plugins.csrgen"

real    0m1,077s
user    0m0,892s
sys     0m0,164s

# time python3 -c "import ipaclient.plugins.ca"

real    0m0,845s
user    0m0,705s
sys     0m0,125s

Deferred import drops python3 -v /usr/bin/ipa help commands 2>&1 | grep ^import | wc -l from 605 to 536.