Forgive my ignorance on this, but do we need a different X509 certificate for each tenant that has Shibboleth enabled, or can it work with a single certificate? I'm assuming it's the former, but in case it's the latter the `spCertificate` ones can probably be `globalAdminOnly`.