Thanks for the answer.
You mentioned that 'if' the default browser is Safari, it will present a digital identity selection UI. Does this imply that if the default browser is Chrome or Brave etc, it cannot show that identity selection UI ?
You also mentioned that Safari builds that list by looking in 'its' keychain. Does that mean that if the digital identity that the MDM puts into keychain cannot be read by Safari ?