Signing the network extension
===============================
To publish a MacOS application with network extensions it is necessary to notary sign it using corporate Apple developer account with enabled Network Extension capability for the application:
https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.networking.networkextension

To add this entitlement perform the following steps:

- In the Certificates, Identifiers and Profiles section of the developer site, enable the Network Extension capability for Developer ID signed app and for extension. Generate new provisioning profiles and download them.

- On your Mac, import the downloaded provisioning profiles in Xcode project settings for the top level application and for AppProxy extension.

- To allow Direct Distribution to any end users modify the text in \*.entitlements files in com.apple.developer.networking.networkextension key. It is necessary to replace app-proxy-provider with app-proxy-provider-systemextension, which is required for publishing the manually signed network extensions: https://developer.apple.com/forums/thread/737894

Then it is possible to build the Archive configuration in Xcode and use notary signing for the result, to allow publishing the extension application for Direct Distribution or App Store. 

For testing and debugging on test machines it is possible to use the automatic signing in Xcode using a corporate Apple developer account without notary step with uploading the archive to Apple.