2016-09-23 UTC
# 
aaronpk rhiaro: it's not that it relies on authentication, it's that the verification process is up to the receiver. so you can have a publicly writable endpoint you can post to and do the verification by fetching, or you can do the verification by checking a signature, or whatever. so it handles any kind of notification payload