ActiveX signing for XP SP2

[Kumarforg]

Hi,

I have an activex control signed using a free digital certificate i aquired
from http://www.ascertia.com.

This works fine with Win 2k machines.

But XP with SP2 requires that the certificate should be installed on the
client machine before it's details are recognised.
The user is promted for a choice only when the root certificate is
installed at his/her end.

Lower the security on client machines is not viable.

Is this the way all digital certification and ActiveX controls on XP SP2
work?
Or would a better(paid) certificate help me avoid the root certificate
installation on the client manually?

regards