Configure VPN EAP-TLS via mobileconfig to use existing keychain certificate/privatekey

Hi,
Due to legacy reasons we are looking to push a VPN EAP-TLS configuration via mobileconfig, but we need to have it use an existing certificate/privatekey that is present in the users keychain.
We believe this is not possible in the .mobileconfig itself as this assumes you would be supplying the certificate/keypair in the .mobileconfig.

Something like the identity-preference for WiFi networks would fit our needs, but we have not been able to identify the service string that would allow us to connect a Certificate to a particular VPN configuration.

We are open to alternatives, we also have the ability to invoke certain Apple API (similar to

CWKeychainSetWiFiEAPIdentity for example).