There is no mention because it's an "hidden feature" inside the OneSignal's block, but in reality Firebase is between OneSignal and my Mobile Apps. OneSignal when delivers a push notification sends the request to Firebase and Firebase delivers push notification to the devices. OneSignal is a service between your code and firebase to manage stuff easier. I didn't mention in the article but if you want to configure iOS you have to provide the certificates generated from iTunes Connect because to deliver push to iOS devices OneSignal must use APN services. I don't know particularly about encryption but I think that all the communications use SSL.