S/MIME - Multiple Encryption Certificates

iOS allows the usage of S/MIME for Exchange Accounts. I can choose a signing and an encryption certificate. Due to the normal lifecycle of publicly trusted certificates, I have to renew them every year. So far ok. The signing certificate does only need to be the newest one. The encryption part shall still keep the old encryption keys.

The iPhone configuration utility does not allow me to select multiple key pairs for encryption.

MDM does not allow me to push multiple key pairs for encryption as part of an Exchange profile.

Due to the need of business for key rollovers and lifecycles, this is a crucial requirement. How can this requirement be met?

Best Regards