In addition, we strongly advise developers to encrypt their push notifications, recommending #WebPush or to adopt a sync-on-push strategy (which is what Signal does). Follow RFC8291, forget about the old draft protocol abandoned 7 years ago!

Shouldn't the protocol mandate encrypting notifications or even disallow any payload in the notification, instead forcing it to be nothing but a wake-up ping?