HomeKit protocol requires end-to-end security.
I have the pre-HomeKit chamberlain door opener so I actually use a series of Shortcuts and works through json and tokens. Way less secure than HomeKit, but I live in a neighborhood fully of nosy retired people. I refuse to give Chamberlain more money (hub) for a feature they promised when I originally purchased the opener(long story). If my garage door sits open for more than 3 minutes with nobody they know going in or out, I get a text from at least one of my neighbors about it. Heaven forbid someone they don't know goes in my garage.
I finally had to explain to a couple of them why I'm perfectly ok with the nice Amazon folks opening and putting packages in my garage. They thought it was lunacy. I, on the other hand, like dry and secure packages.