The app decrypts the message and displays it via the system notification.
Am I missing something here? Maybe I'm missing a subtle detail.
[1] Well actually they just send a blank notification, the signal app then reaches out to the signal server for the actual encrypted message content when it receives the empty notification.