Split the build process so that you can click "version 1.2.3" and have it notarized (this is doable in Jenkins for example)