In the related pypush repo it mentions something about hardware serial numbers used in rate-limiting, etc. So I guess they do something?

But yes, I was expecting it to be based on some kind of hardware root of trust certificate system that comes from deep within the hardware and secure enclaves!