also, yeah, it really should include auth but unless i'm mistaken, that is entirely the responsibility of the client side to implement correctly, as far as i can tell, otherwise it's just a matter of having a side channel to negotiate the connection key

i think that the issue of privacy in this is best resolved by using nip-44 encryption, giftwrapping the messages, and, you know, not putting anything but the wallet/client connection details outside of the giftwrap

it's something i want to work on, in the future, my relay project is ready to deploy for this kind of use already, just that the part involving managing subscriptions has not been implemented, this can be entirely separate, running on a separate server because it is managed by follow lists, not some extra protocol