Yeah, I found a mistake already. Added -systemextension in the wrong place. The app runs ok now but Tunnel Extension isn't working. It's working when signed with Apple Dev cert but not when signed with Developer ID cert. Found this error in Console: Validation of the extension failed. Any ideas what could that mean?

Also this in Console from networkextension: Signature check failed: code failed to satisfy specified code requirement(s). It's almost like it doesn't like that -systemextension suffix. But I added it as per docs packet-tunnel-provider-systemextension

Notarised Developer ID dmg without errors but still Validation of the extension failed in the Console

well I changed App Extenstion to System Extension and notarised Developer ID dmg without errors but still getting Validation of the extension failed in the Console when trying to use sysex