X11 forwarding with Short-lived certificates

Zero Trust Access
1

I have set up the server to utilize short-lived certificates for user login. However, I have noticed that X11 forwarding is disabled due to key options.
debug1: Remote: X11 forwarding disabled by key options.

Is there any way to have Cloudflare sign the key without the “no-x11-forwarding” option? I have been unable to find a method to ignore this key option.

3

I am also interested in X11 forwarding with short-lived certificates.

Can we enable the permit-X11-forwarding extension on the short-lived certificates? If this isn’t desired for all users, could this be configurable per (Access) application?