The Push API defines a push service as
a system that allows application servers to send push messages to a webapp.
A subscription to the service is created via a call to serviceWorkerRegistration .pushManager.subscribe() without any parameters.
How is the URL for this push service configured? I would have expected .subscribe() to take a URL parameter for the service.
The Push API's sister spec, Generic Event Delivery Using HTTP Push, says:
push service: This resource is used to create push message subscriptions (see Section 3). A URL for the push service is configured into user agents.
But it does not specify how this configuration would take place.
This quote from the second document you cite answers the question:
This document intentionally does not describe how a push service is discovered. Discovery of push services is left for future efforts, if it turns out to be necessary at all. User agents are expected to be configured with a URL for a push service.
For now browsers are shipping with built-in knowledge of some specific push service, such as GCM in the case of Chrome. This is mentioned in the Push Notifications on the Open Web article on HTMLRocks:
Chrome uses GCM to handle the sending and delivery of push messages.... Other browsers are free to use any push service...
But it would be interesting to see whether browsers might be opened up in the future, so that, as you suggest, we could specify our own chosen service in an argument to subscribe.