We basically have to options: - Auth with a key used by the Push Server itself. Everybody would have to white list that key to download their own DMs. - Change the relay spec to allow a REQ, authed in the past by the user, like on https://github.com/nostr-protocol/nips/pull/1148/