Doesn't the NEST encrypt all traffic to the cloud? So it's not a local API right? I mean, the same can be said of the MS [...]
Exactly. Google are control freaks just like Tesla so all the traffic from their devices (Thermostat, Smoke detector, Dropcam) to their servers in the cloud are encrypted and they do not provide official local APIs. Hackers have figured it out and there are unofficial NEST API in a dozen languages, but NEST has no intention of enabling anyone to integrate without going through their managed APIs in the cloud, joining their developer program, complying with their terms and conditions, etc.
Tesla could do this as well for the types of apps we have been writing using the REST and streaming endpoints. They have everything they need in place. I checked a few of the standard OAUTH 2.0 URLs and parameters and they seem to work. They just need to expose a Web Page to register third party apps, assign client ids, client secret, and a redirect URI (or a PIN) for allowing the users to approve the third party apps.
The SDK for the car is something different because it would run locally on the console, likely in a sandbox, but with some (optional) access to the cars subsystems for bluetooth, navigation, the dashboard display, etc. These apps unfortuately must be tightly controlled (i.e. approved) by Tesla to comply with government regulations and ensure safety. This is a much larger effort to setup this kind of a developer program because it requires Tesla to setup a Tesla App Store, and dedicate people to an application approval process for the candidate apps. They also need to build a bulletproof sandbox on the car or they risk negative press about some rogue app taking over control.
I figure, Tesla will walk before they run so I hope to hear about a developer program with OAuth 2.0 authentication of registered third party apps and a REST and Streaming REST API that pretty much matches what we already know.