I love embedded servers. I don't think adding SSL would be that hard. I've done something very similar in C# and kept putting off SSL, only to find that X.509 authentication was trivial.
The harder part is maintaining session info between requests and garbage collecting dead sessions, though you could just authenticate each request.
not sure why you would think that! objective-c uses a dispatch method for message-passing which is a little slower than direct function calls, but it rarely slows things down in practice. even if it does, there are ways around it: for speed-critical code you can circumvent message-passing and call functions directly.
cocoa code ends up being compiled, after all. that makes it lots faster than the latest scripting languages.
The harder part is maintaining session info between requests and garbage collecting dead sessions, though you could just authenticate each request.