From working with this tool for a bit, I think the following additions would be useful:
1) The tool warns/errors on cased role names being converted to lower case, but still prints the cased name in the log. For clarity these should also be lower cased.
2) When not importing, we should still print a message about what we would do, i.e. a dry-run message.