The question about how to notarise an installer package (.pkg) containing a KEXT has come up on a number of threads [1] over the past few weeks. Unfortunately my answers have been less than clear, so I sat down with the notarisation team to fix that. The fundamental question here is the order in which you notarise things. Do you:Sign the KEXT, wrap the KEXT in a signed installer package, then notarise the package, then staple the ticket to the package (option A).Sign the KEXT, then notarise it, then staple the ticket to the KEXT, then wrap the KEXT in a signed installer package, then notarise the package, then staple the ticket to the package (option B).We generally recommend option A, because option B requires multiple round trips to the notarisation servers.For installer packages that don’t contain a KEXT, this is the end of the story. For installer packages that contain a KEXT, there is one extra gotcha. The gotcha, a