From day one, HomeKit had hardware PKI (and strong crypto with a hardware security module on all their devices). All their authentication and messaging was fully end-to-end encrypted, but again, all _in hardware_. [1]
But the beauty of it was, you never felt that complexity in software as a customer. It's the proverbial Apple product. The tradeoff is, because you need this special hardware HomeKit chip, the ecosystem is pretty dull, or too expensive. And that's held back HomeKit adoption.
After playing chicken with the industry for years, Apple finally gave in and is allowing software HomeKit devices to get certified now. That actually does away with some of the security IMO. But that's ok, it bothers me slightly less to have HomeKit software based lights. Whereas, I wouldn't compromise on that when it comes to security (like locks on my doors, or the garage door).
Hope that helps.
While I've had aspirations to get more into home automation from the business side, most of my experience is as a consumer, so weigh my input that way. :-)
It's definitely our goal to have a large ecosystem, of both hardware and software.