Finally got this working!
Tested with a IPA signed with cert1 for app store submission with no devices added in the provisioning profile. Results in a new IPA signed with a enterprise account and a mobile provisioning profile for in house deployment (the mobile provisioning profile gets embedded to the IPA).
Solution:
Unzip the IPA
unzip Application.ipa
Remove old CodeSignature
rm -r "Payload/Application.app/_CodeSignature" "Payload/Application.app/CodeResources" 2> /dev/null | true
Replace embedded mobile provisioning profile
cp "MyEnterprise.mobileprovision" "Payload/Application.app/embedded.mobileprovision"
Re-sign
/usr/bin/codesign -f -s "iPhone Distribution: Certificate Name" --resource-rules "Payload/Application.app/ResourceRules.plist" "Payload/Application.app"
Re-package
zip -qr "Application.resigned.ipa" Payload
Edit: Removed the Entitlement part (see alleys comment, thanks)