Pushover uses SSL, and then hands off to GCM for notifications. Yes, it's not end to end and you don't control the keys, but it seems to be the best current option and is MILES better than Pushbullet, who have yet to come up with a way to monetize.

https://pushover.net/faq#security

They also have a warrant canary for what it's worth ttps://pushover.net/canary.asc