Hey there, this Petri article should do the trick: http://www.petri.co.il/install_windows_server_2003_ca.htm
Then, once you have that built, you would have each user request (and have your CA) issue a cert.
http://www.petri.co.il/obtain_digital_certificate_from_online_ca.htm
When you request and and get your cert issued, the default behaviour is the (soft) cert will be copied to the local certificate store of their computer (ie. each user will have their own cert, on their own PC). When they go to sign an infopath form (you will probably discover there is more SharePoint configuration to come, the above just deals with the CA and user cert as requested), the cert store will present their cert (and won't be aware of others)