Avoiding .Net CAS Policy changes for FullTrust?

Question

I've got a .Net assembly served from a (non-IIS) website (invoked ActiveX-style with an OBJECT tag) that needs FullTrust permissions.

<OBJECT id="myControl1" name="myControl1" classid="MyControl.dll#MyControl.myControl">

I can do this by modifying the CAS policy on each client machine like this:

caspol -machine -quiet -addgroup Trusted_Zone -site mysite.com FullTrust -name mysite -description "Relaxed policy"

What I'd really like to do is just get mysite.com added to the client machines IE "Trusted Sites" and not have to change any .Net policy settings.

Is this possible? Perhaps by signing the assembly with a trusted CA?

Or am I stuck with getting the machine admins to agree to CAS policy changes?

Thanks.