Took about 3 hours to get all the certificate stuff to a passable state. I didn't quite understand what I was doing, but hopefully the zip file is now acceptably signed. If I understood correctly, I needed some kind of different certificate for releasing the app than I did for testing it.