We have exactly the same need as original poster and this sure is bad news if that's still the case? And I'm so new to this that I don't know of a quick way to test it (yet, but I'm trying to understand this more in depth). Maybe somebody can confirm if newer versions can actually do it better, ie. add custom headers and the x5t header parameter?

Also, @Matthew Cummings if you are still active here, would you like to tell if you at the end managed to create what you needed (and which is probably exactly what we need, too)