It appears that safari web extensions can only go through the app store. In order to distribute it outside, is it sufficient to use a valid Developer ID cert or does it need to be notarized? I understand that users would have to click Allow Unsigned Extensions. Do they have to do this every single time even if a valid cert is used to sign the app?