Isn't it possible to remove a single client certificate from a device?
On a Galaxy S6 running 5.0.2 I can remove all client certificates using:
System settings
Lock screen and security
Other security settings
Clear credentials
Or I can delete a single trusted CA certificate from:
System settings
Lock screen and security
Other security settings
View security certificates
User
However there seems to be no option to remove a single client (non-CA) certificate.