All data brokered by the service must be encrypted to a keypair whose private key is held only by the end user&#x27;s browser, using the scheme described in the webpush-encryption IETF draft spec at <a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;draft-ietf-webpush-encryption-01" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;draft-ietf-webpush-encryption-01</a>