Thanks Mike,

That's kind of what I was thinking ...from
http://msdn2.microsoft.com/en-us/library/ms925919.aspx

Getting a CSP (Cryptography Service Provider) Signed
"In accordance with the U.S. Department of Commerce's export restrictions
concerning cryptography, Microsoft must digitally sign every CSP so that it
will run on Microsoft operating systems. The primary purpose of the digital
signature is the protection of the system and its users. The operating
system validates this signature periodically to ensure that the CSP has not
been tampered with. A secondary effect of the digital signature is that it
separates applicable export controls on the CSP from the host operating
system and applications, thus allowing broader distribution of
encryption-enabled products than would be possible under other
circumstances"

Which seems to indicate that applications that use the Windows CrytopAPI
(and I think .NET apps call into the .NET Framework, which in turn calls the
CryptoAPI) are not themselves restricted.

Cheers