Many large corporations choose to use their own CA to sign their employee's SMIME certificates. Which is fine for internal use, but they typically expect external users to import their corporate CA into their email client's certificate store.
I find this expectation unreasonable, as I do not want to trust any more CAs than I already have to. Even without assuming malicious intent, I don't know how well these corporations protect their private keys.
Unfortunately, some of these corporations are our customers. And I'm not going to convince a Fortune 500 company to change their ways by purchasing SMIME certificates from a public CA.
Is it possible that I somehow re-sign single SMIME certificates from my correspondents with my own CA, which I then import into the certificate store? This would be a client-agnostic solution to the whole issue. Of course I'd verify the certificate's fingerprint beforehand over the phone, mimicking the workflow of PGP.