That is very good to know about the flight-safe CO calibration gas canisters. I use air monitoring equipment as part of my job, and we frequently use various calibration gases that we usually have to ship as "dangerous goods" due to the restrictions on compressed gases on planes.
In answer to the questions about CO vs CO2, it has been ably answered by Swamp and Don, but just to pile on, the "bump" testing we are referring to is really just an operational check on the sensor. If it reads anything, you at least know the sensor is working. But since you don't know the exact CO in your exhalation, you don't really know that the value the sensor is reading is correct. So it isn't really a calibration, just a sensor operation check. Ideally, you want to do a two point calibration, which is where the calibration gas canister comes in. If you tell the sensor what zero looks like, and use the cal gas to tell it what 10 ppm looks like, then it can more effectively extrapolate to whatever concentration you are trying to measure. With just the zero check and the sensor operation check, you have to be very careful accepting that a 9 ppm reading isn't actually a 15 or a 20. I don't think the calibration on CO meters drifts as much as sensors for things like H2S or volatile organics, and humidity isn't as a big a factor, but I would treat any reading above the low single digits as cause for significant concern unless I had calibrated the meter very recently.