Ah, the dates of the comments at the bottom helped explain the lack of modern day issues we now hit - 3p cookie depreciation and the Chrome Samesite change. Both of these break logout, but certainly weren't a concern in 2008.
This post indicates that 3p cookie issues only affect SSO providers without a hostname that lives within the primary websites domains: https://blogs.akamai.com/2020/01/cookies-single-sign-on-and-... (so SaaS offerings without domain masking). Is that your understanding?
Here's an interesting post on the samesite implications: https://www.troyhunt.com/promiscuous-cookies-and-their-impen...
We documented the login breaks from Samesite and 3p cookies, but logout was both not particularly a concern for folks (I've gotten about three inquiries in two years), and pointless to document tombstoning patterns for Samesite since ITP would break those anyway.
https://docs.microsoft.com/en-us/azure/active-directory/deve...
I did some research while back and found that shibboleth supports local storage for sessions [0], unfortunately the IdP+SP I'm using do not support such a thing.
[0] https://wiki.shibboleth.net/confluence/display/DEV/IdP+SameS...