My addin projects may require "signing" for a particular client who
wants to run Office security at HIGH. I've never done this before. I
read quite a bit about it but still have questions.

Do you have suggestions for a good certificate authority or are they
all the same?

I think I'm a class 2, because I'm an individual, not a retail company.
Is that right?

Once I get the certificate and sign my project, is it then
traditionally the client's responsibility to impliment what they need
on their end (server/machines) to make the security work?

After signing, do all changes to the project then have to be created on
my specific machine for the signature to revalidate before
distribution?

Any pointers for more tutorials/information on this subject?

Thanks,
Chuck