Don, For what it's worth, we have a number of SPs that use a different signing credential, and we have a single config that can send using either signature and we don't change our IdP entityID for this. There's nothing stopping you from keeping one config for both and using the relying-party.xml to use the different signing cert with the SP.