https://developers.google.com/web/fundamentals/push-notifica..."A PushSubscription contains all the information we need to send a push emssage[sic] to that user. You can "kind of" think of this as an ID for that user's device."
"A push service receives a network request, validates it and delivers a push message to the appropriate browser. If the browser is offline, the message is queued until the the browser comes online."
"Each browser can use any push service they want, it's something developers have no control over. This isn't a problem because every push service expects the same API call. Meaning you don't have to care who the push service is. You just need to make sure that your API call is valid."
"The data you send with a push message must be encrypted. The reason for this is that it prevents push services, who could be anyone, from being able to view the data sent with the push message. This is important given that it's the browser [not the user] who decides which push service to use, which could open the door to browsers using a push service that isn't safe or secure."
"When you trigger a push message, the push service will receive the API call and queue the message. This message will remain queued until the user's device comes online and the push service can deliver the messages. The instructions you can give to the push service define how the push message is queued."
"When the push service does deliver a message, the browser will receive the message, decrypt any data and dispatch a push event in your service worker. A service worker is a "special" JavaScript file. The browser can execute this JavaScript without your page being open. It can even execute this JavaScript when the browser is closed. A service worker also has API's, like push, that aren't available in the web page (i.e. API's that aren't available out of a service worker script)."
Hard to imagine how anyone could forsee that such a "feature" could be abused.