Only one S/MIME certificate per account is used for decryption, even when multiple certs are imported

Steps to reproduce

1. Import multiple S/MIME certificates for the same mail account under Settings → Mail → S/MIME (e.g. after rotating keys — old cert(s) plus a new one, all valid and covering the account's email address).
2. Receive/have stored mail that was encrypted under an older cert (one of the multiple imported certs, not the most recently added one).
3. Attempt to open that message.

Expected behavior

The Mail app should attempt decryption against any of the account's registered certificates whose private key matches the message's recipient info in the S/MIME CMS envelope — not just a single actively-associated one.

Actual behavior

Message displays "Not Found." Server log shows:

OCA\Mail\Exception\SmimeDecryptException: Failed to find a suitable S/MIME certificate for decryption

thrown from SmimeService::decryptDataFetch via ImapMessageFetcher.php.

Mail app version

5.10.12

Nextcloud version

33.0.2

Mailserver or service

Stalwart

Operating system

Debian LXC

PHP engine version

No response

Nextcloud memory caching

No response

Web server

No response

Database

MySQL

Additional info

Confirmed not a key-validity issue: the relevant private key was independently tested by importing the same .p12 into Betterbird, which decrypts the exact same message successfully. All 3 certificates are present and valid in the account's imported S/MIME cert list.

Suspected cause: oc_mail_accounts appears to store a single smime_certificate_id per account (referenced in #8552), suggesting the decryption path may only ever attempt the one currently-associated certificate rather than iterating through all certs imported for the account. If so, this would explain why rotating S/MIME keys — a routine PKI operation — breaks access to previously-encrypted mail even when the old key is still available and correctly imported.