A protocol being fully documented does not mean you can get a device you cannot control (like an Homekit lightbulb) to connect to your server instead of the manufacturer's. If requests are signed and/or encrypted, knowing the protocol won't help if you don't have the keys. See also Tivoization.
> For example, search the web for ‘homebridge alexa’
I had found it. I don't think you realize that there's no Homekit there at all.
The point of Homebridge is to translate from a Homekit-speaking control app/assistant to a non-Homekit-enabled device:
https://blog.theodo.com/wp-content/uploads/2017/08/workflow....
But when you use homebridge-alexa, you're replacing that first link with another protocol (specifically, MQTT+JSON, which is what it uses to connect to https://www.homebridge.ca/).
So you've actually removed all Homekit parts from your smart home system!