Push Notifications are a bit more complicated than just sending a cURL request.
You need to also handle network errors, check delivery receipts and handle devices that are no longer associated (ie: uninstalled or disabled the Push Notification permission)
Or you risk losing the ability to deliver Push Notifications!
The federated aspect adds more complexity as our PushProxy needs to enforce and reply to origin accordingly, while being as performant as possible
For Smithereen, I plan on just having app developers include their push keys in their app metadata. They're not of any use without device tokens anyway so they should be safe to publish. The sending will be done by each user's server, there will be no centralized push gateway.