PSD2 support needed for PayPal by Sept 2019
PayPal will require PSD2 support by September 2019 - in Europe, anyway (https://www.paypal.com/uk/webapps/mpp/psd2). So Civi will need to support SCA via 3-D Secure when using PayPal - Website Payments Pro (and presumably for any other payment methods where Civi hosts the payment fields). In practice I think this'll mean an intermediary page after payment, where people can verify their card details.
We are happy to chip in on development of this, but we can't fund it entirely.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information