Excellent read and your honesty is definitely appreciated since this is a very similar sitatuation to what us IT Consultants and Admins go through with new products. Many of us test them the exact same way, and I ran into quite a few of the same issues as you back when I was testing with Beta 2 (have since moved my server to a production environment).
I think that it is worth mentioning thought that there are easier ways to do this Dynamic DNS. The best service IMO is from a company by the name of DynDNS. Since a Dynamic IP is being used though it is obviously not possible to set up a reverse lookup, so you will need to send mail out using another mail server (not using DNS); this can be configured using the send connector. Then just make sure that the DynDNS client is installed on the server so that it can update all of the necessary hostnames.
Then for certficates for things like this I always recommend GoDaddy. GoDaddy certs are only $20 and work with all Microsoft stuff (including WM5 or greater phones).