Totally agree with previous speaker, i.e. if you want to keep your sanity: static link all the things.
(I've done a similar journey, like when shipping a dynamic build everything was fine on a vanilla customer PC, but if they happened to have Qt installed, then interestiing problems/collisions would occur :-)
Just want to add re. certificates. You need them. But a hardware key can set you back 500 US$ and as Simon mentions above, can only be used on a single computer.
Instead I use Microsoft Azure Trusted Signing, costs 10 US$ every month but it can be used on multiple PCs :-)
One odd thing is that their certificates only are valid for 3 days, but don't worry they will work for you. For an in depth explanation look here