Alright, I think I get what you’re after now. Let me check my understanding. You’re looking to have one identity, with one external-id, then mint n separate certificates with that external-id in the cert so that any certificate with that external-id appears as that one singular identity. I think I got it.
Since this is so new, and I’ve not been able to get it to work in my own lab, we’re gonna have to wait for andrew to come back next week on this one. 
We’ll pick it up in a few days.