Aha, I see what's going on. Apps are identified in the app store with a unique bundle identifier. That's set in info.plist, and by default it's:
com.yourcompany.${PRODUCT_NAME:identifier}
Which for me resolves to:
com.yourcompany.CheckWord
(Note that "yourcompany" is actually the string "yourcompany, not some macro that is replaced by your actually company name.)
To sign your code you need an App ID that contains a string that matches the bundle ID. In this case it could be any of the following three strings.
com.yourcompany.CheckWord
com.yourcompany.*
*
If you are going to have more than one application, then Apple recommends you use a wildcard. To simplify matters further, they now recommend you just use "*"
In order for your app to go into the App store, it needs a unique Bundle ID. In my case I made a mistake in leaving the Bundle ID as com.yourcompany.CheckWord, as that's not unique enough (imagine there might be a few com.yourcompany.Flashlight ids, if everyone did that). However it got accepted, and that's the ID I'm stuck with for updates to Checkword.
So ideally what I should have done is enter a * in the Bundle Identifier field of the App Id generator, and use com.mickwest.CheckWord as my Bundle Identifier in info.plist.
I would then use the same wildcard App Id for all future apps I develop.