I also added SSL to a site "too late" by hivemind standards. It's static HTML and contains nothing sensitive. I guess maybe a malicious ISP could theoretically inject ads or something.

I don't think he believed it was a protocol in a literal sense, but that people were using it like one. It had an open API at the time and both production and consumption of tweets was often automated. It didn't really work out that way longer-term, but it wasn't crazy to guess that it might.