Great question, I haven't tested this, yet. One thing I'm sure would work if the user has generated two separate public-private key pairs and you sign two diff

Great question, I haven't tested this, yet. One thing I'm sure would work if the user has generated two separate public-private key pairs and you sign two different certs. Not so sure about having several certs for the same key. If I was in that situation, I would probably generate a new cert which contains the concurrent claims and is short-lived, but we also don't have extremely many different roles.