PacketTunnelProvider Systemextesion : OSSystemExtensionErrorDomain error 8

Hi,

I have a PacketTunnelProvider system extension which I am now building for Distribution using Developer ID certificate.
I have correct provisioning profiles as well as entitlements required for distributing system extensions as mentioned in Network Extensions Entitlements.

Note: I have a test machine with SIP disabled as I have not yet Notarized my app and the system extension.

After build and code signing is successful, I take the product to my test machine and try to run my app.
My App comes up successfully but it submits an activation request for system extension, following error is observed:

System extension request failed: The operation couldn't be completed. (OSSystemExtensionErrorDomain error 8.)

I think error 8 stands for invalid code signature, but my provisioning profiles and entitlements are correct.

Can we not run a system extension with SIP disabled?

Is Notarization a mandatory requirement for system extensions to run?

Thanks