And given most companies run managed browsers on managed systems, the user agent is going to collide too

Not just inside a company network. CGNAT is pretty commonplace nowadays.

Indeed. This is one of the limitations to our approach. We're thinking of ways to workaround it. Please shout if you have any ideas ;)