> It seems to me that they should have a number of enterprise signing certs for each use case such as internal beta, external beta, internal utility, external utility, whatever.

Then you need each user to install each cert.