ConfidentialClientApplicationBuilder.WithCertificate(IAppConfig => X509Certificate)
This would provide a callback to obtain the certificate based on clientid and authority/tenantId. This function would need to be evaluated each time before ExecuteAsync is called.