Thank you for the detailed information.
Could you try to create a new cert also with Client Authentication and Secure Email just that we know the problem is really this and not the original certificate itself?
Unfortunately, the signing logic is in a third-party library we use and I didn't find notes there about this topic.