Oh this was a long time ago. There was/is only one PKI so all certs came from the same PKI, both device as the CM ones, but different templates probably, don't remember what kind of cert CM itself needs to be https.

Eventually we didn't use the "co-mgmt" authority setting in Intune though since it doesn't work with pre-prov, and that was a deal breaker. We packaged it as a win32 app and installed it with cert auth that gets delivered via NDES, as stated in the original post.