Yeah I'm just a lowly indie iOS app developer but I remember way back in iOS 10 when Push Notification Service Extensions were introduced and one of the examples used (indeed, in the current documentation as well) was to be able to have the contents of push notifications be encrypted over apns and decrypted on-device.