I feel like putting the responsibility at the consuming end is right (given plain dictionary configs).

Currently, the container publicises the config object it was given directly. So the pattern here is consistent with everywhere else (e.g. timer interval, SQLAlchemy URI, AMQP URI, number of pool workers -- that's something that needs type coercion). 

If you don't clean at point of use, this puts a responsibility on the container to know about the configuration any consumers need, which doesn't fit well if you then develop some custom entry-point or injection of your own.