furthermore, let's assume (now, that it's obvious that this add-on needs to be signed) the signing is supposed to take place on a current debian system...
...and, last but no least, this system should also run a xulrunner in ver.> 1.8.1
these constraints will lead (among others) to the following packages:
libnss3-1d, 3.12.0~rc3-1
libnss3-tools, 3.12.0~rc3-1
in case the signtool refuses to do part of its job (and complains about missing libraries) this might help:
ln -s /usr/lib/nss/libsoftokn3.so /usr/lib/libsoftokn3.so
ln -s /usr/lib/nss/libnssdbm3.so /usr/lib/libnssdbm3.so
ln -s /usr/lib/nss/libsoftokn3.so /usr/lib/libsoftokn3.so
ln -s /usr/lib/nss/libnssdbm3.so /usr/lib/libnssdbm3.so
related: