Yes, the spec is the most detailed description of what goes on under the hood and it's not too long: https://www.w3.org/TR/push-api/, but here's my attempt at answering each of your questions:
> Does the browser maintain an open connection (like a Websocket) for each subscription, or there are some brokers, or if it can use OS facilities (like GCM/APN on mobile) when available, etc etc.
Yes. Chrome maintains an open connection to Google's push servers, Firefox maintains an open connection to Mozilla's push servers.
> In particular, I'm curious of privacy implications. When I subscribe - what site knows of me (say, if that's a direct connections, I'm not sure I want to tell every site out there when I'm online), or if any third parties are involved - what they know and do (say, what's about sender and receiver authentication)?
The Push connection itself would not reveal whether you are online since it's made to Google/Mozilla and not other individual sites, however the presence of a Service Worker could be used to determine this. For example, a website could send a background notification and check your network connectivity from the Service Worker without necessarily showing you a visible notification. This is already true for push notifications most people already receive from mobile apps.
A common use for these kinds of background notifications would be to do background data loading (such as loading new email messages to view later offline).