Flow: sign with a Developer ID Application or Installer certificate and the hardened runtime, run xcrun notarytool submit app.zip --wait with an App Store Connect API key or app-specific password, then xcrun stapler staple the app, DMG or package so Gatekeeper can check it offline. Since 1 November 2023 the service accepts uploads only from notarytool (or Xcode 14 and later), not from the retired altool path.
Notarization is not App Review: it checks for known malware and signing problems, not behavior. Gatekeeper on current macOS versions blocks unnotarized Developer ID software by default, so distribution outside the App Store effectively requires it.