I’ve done this myself, including using a C++ shim to authenticode sign my add-in to get around

http://blogs.msdn.com/brada/archive/2004/04/15/114332.aspx