Catalina is checking notarization of unsigned executables

This must be a blacklist, since it doesn't block my own random scripts which it has never seen before.

If it's a global blacklist on apple servers, it should instead be downloaded to the client, and be a local blacklist.

Too big? Use a bloom filter. Now you only end up keeping less than one byte per blacklisted item. Update the bloom filter with an autoupdater. Any positive hit you can check against the server just incase it's a false positive.

Doesn't a blacklist also work only until the malware authors figure out how to randomize 8 junk bytes every time they serve an executable?