As you've noticed stapling is not supported for .zip packages (there is nowhere to put ticket), this is correct. macOS will indeed download and check notarization ticket for your binary upon first launch. But if there is no internet connection, this will fail and you will get nasty Gatekeeper alert. What you can do — create a package that will install you daemon (and probably launchd plist and some bootstrap script I guess) with pkgbuild and productbuild. Product package can be signed, notarized and stapled.
Topic:
Code Signing
SubTopic:
General
Tags: