There's a flag that can be set (I don't remember if it's in the cert itself or during the import process) that makes the key un-exportable. The idea is each ce

There's a flag that can be set (I don't remember if it's in the cert itself or during the import process) that makes the key un-exportable. The idea is each cert identifies a device. There's no reason to not just issue one cert per device, especially if you make the enrollment process fairly painless. If a user loses their phone, it's very nice to not have to revoke their one global cert -- just revoke the one that was used on the phone and be on your way.