If you push your packages with MDM, you don’t need to notarize

Good point, but for people with customers who aren't gonna be on MDM 100% of the time, we need to have a good workflow to get that done too. For internal needs with MDM there's probably no need for EV certs etc either 🙂

sure, but osquery is also largely going to work less and less for customers without mdm

Yep

kolide builds unique packages for each customer because it includes enrollment secrets /config specific for that customer

We do that too at Uptycs

and use a different method for configuration

I think I would rather have a immutable package, and have a way to specify config with arguments than hope notarization will always happen at the speed I would want it to, but who knows maybe it'll scale too!

there’s other tools that ship config (cisco comes to mind)

yeah definitely not a unique use case