Great breakdown, this matches my experience almost exactly, just with a different piece of CI. I went with GitHub Actions (macos-latest runners) + Fastlane instead of EAS, mainly to avoid the build queue times and to keep the signing config in a repo I own rather than tied to an Expo account. Fastlane match handles certs/profiles headlessly, similar idea to what EAS does for you, just self-hosted. Packaged it into a pipeline called Macless (macless.dev) since getting the Fastlane match setup right the first time was the fiddly part. The certificate objection is the right one to lead with, it's the thing that scares people off before they even try.