Alrighty Then!

With the new, official certificate from Chosen Security, i created a new version of GeoFeeder (with only an increased version number) with my new certificate. Then used

..\sdks\3.2.0\bin\adt -migrate -storetype pkcs12 -keystore self_signed_cert.p12 GeoFeeder_121.air GeoFeeder_121_certswitch.air

to manually wrap it with the old, self-signed signature. This way an update can be verified by the installed version (via the old “outer” signature) and on-thy-fly migrated to the new cert (via the new inner signature).