Setting (or querying) the kSecAttrProtocol property of a generic password is not meaningful, AFAICT.
AFAICT it is only meaningful for an Internet password, which Sparkle does not use.
Therefore, the 3 instances of setting or querying for kSecAttrProtocol with value kSecAttrProtocolSSH don't seem to be wrong, per se, but sure are misleading!
https://github.com/sparkle-project/Sparkle/search?q=kSecAttrProtocol&unscoped_q=kSecAttrProtocol