But it looks like they use a wrong technique to get the right tos-url by extracting the redirect target from the url https://acme-v01.api.letsencrypt.org/terms.
The right way would be to retrieve the /directory api endpoint and use the value of the field 'terms-of-service' from the meta-element:
$ wget -qO - https://acme-v01.api.letsencrypt.org/directory | grep terms-of-service
"terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf"
Thats clearly a bug in dehydrated.