Feature request: Metadata only serves one encryption certificate

[mcab]

When using both certificate and alt_certs when creating a ServiceProvider, certain identity providers do not like the metadata generated.

const fs = require('fs');
const saml2 = require('saml2-js');

// Generate a certificate with:
// openssl req -x509 -sha256 -nodes -days 3 -newkey rsa:2048 -keyout old.pem -out old.crt -extensions v3_ca
var sp = new saml2.ServiceProvider({
    assert_endpoint: "https://sp.example.com/assert",
    entity_id: "https://sp.example.com/metadata.xml",
    certificate: fs.readFileSync("new.crt").toString(),
    private_key: fs.readFileSync("new.pem").toString(),
    alt_certs: [fs.readFileSync("old.crt").toString()],
    alt_private_keys: [fs.readFileSync("old.crt").toString()]
});
var metadata = sp.create_metadata();

console.log(metadata);

Taking that generated metadata and using it (for example) with ADFS:

Searching for MSIS7508 indicates that ADFS does not know what to do with multiple encryption certificates.