<http://msdn.microsoft.com/en-us/library/bfsktky3%28v=VS.100%29.aspx> states that the makecert tool is for testing purposes only.

I realize you wouldn't want to distribute a self-signed certificate in a production scenario, but the tool also allows you to sign a certificate with an issuer's certificate. So, would it make sense to purchase a certificate from a certificate authority, keep it as safe as possible, and only use it for the signing of other certificates (possibly generated by makecert)? In that case, if one of those certificates where compromised, you could revoke it and issue a new one without purchasing another certificate.