Yes you could, but it's tricky tho. What is that metadata? What it reveals? If you use some sort of symmetric scheme to share a common ping/nonce/key you also need to have some handshake to establish that
Discussion
I guess that depends on what the vending machine is vending. Maybe if it's a request to do with something that's already public on Nostr then info about that already-public something, as long as no info about the npub themselves.
Hmm this is not strictly related with dvms more with secure private communication. Gift wraps just reveal the public key of the receiver