I love this idea

Yeah so thinking more about this it's doable but won't be possible for the whole payload since I don't want to ship the APNS/SNS payload builder on clients since that can cause versioning issues if app expects one format but your older HA instance sends something else. So you would be able to encrypt any text, but things like the sound name and category key can't be encrypted. Guess it still provides some value but at lower rewards.

I am pretty nub when it comes to notifications so apologies if this is just completely incorrect but would it be possible if you ship the APNS/SNS payload builder on clients, but keep each version in the client, so part of the unencrypted payload would be a client APNS/SNS builder version and based on that you can pass the encrypted payload to the correct builder version?

At some point you can start deprecating older versions of hass completely and just remove older builder support from clients at that point.

But.... that sounds like a lot of work :'(

Yes, that is generally the correct way to do such a thing.

gotcha!

Reopening this as mobile_app added native support for encrypted communication with the app and I am midway through migrating the app to FCM, so now is a good a time as any!

This might be a good use case for Paulus' idea of using a QR code in setup of mobile app. Good way to get a code into the app.