I don't think there was ever a mention of non-hardware authentication in the FAQ in the past (or even an FAQ at all). There was also never a public PDF of HAP until this year's WWDC, and the link to that PDF also explicitly states that it is for non-commercial products:

https://developer.apple.com/homekit/specification/

Edit: also confirmed this in the WWDC video at 28:20 https://developer.apple.com/videos/play/wwdc2017/705/?time=1...

And let's say you come up with a really cool prototype? And now, you want to develop a HomeKit accessory for commercial sale. You need to join the Apple MFi Program. You need to join the Apple MFi Program and go through self-certification before you can begin your manufacturing or sale of your accessories. And this is really exciting.