You say "install python-tornado, which will pull in python-backports-ssl-match-hostname". That's not true in sana/kali-rolling it was the case with an old python-tornado (4.0.2-0kali1) but now we have 4.2.0-1.

And the new python-backports-ssl-match-hostname is just an empty package pulling the new python-backports.ssl-match-hostname (coming from Debian).

So the problem you describe should no longer be reproducible. At worst the upgrade is done in a bad order and you get a file conflict once between the old python-backports-ssl-match-hostname (3.4.0.2-0kali2) and the new python-backports.ssl-match-hostname. But as soon as python-backports-ssl-match-hostname is upgraded to 3.4.0.2-0kali4 then the problem goes away.

Do you confirm that the problem no longer exists with an up-to-date sana system?

Perhaps armhf is lagging behind, but I'm still showing python-tornado as 4.0.2-0kali1 here. I ran apt-get update a few minutes ago to be sure. I have

sana and sana-proposed-updates enabled here and don't see that update yet.

Duh. We have the correct version on repo.kali.org, but for some other reasons the mirrors have not been synchronized lately... so you still have the old version on your mirror. I just fixed this and the updated packages shall appear shortly.

Looks like that was it. I did have to apt-get -f autoremove, but am able to have both python-tornado and python-websocket installed now.