I was assuming that each SP/tenant would need to have a different certificate but I can't find any proof for it. (It seems testshib doesn't have this requirement, but then it allows you to register an SP anonymously trough a form, so they probably don't enforce the strictest regulations.)

I'll make it a globalAdminOnly field. If they do need to be unique, we can always do that later.