Hi,
"Endpoint" in this context means "twisted endpoint". Twisted endpoints provide an abstract (but not too abstract) means for doing things like listening and connecting, and include TLS support.
An example (minimally specified) TLS endpoint: tls:example.com:443.
Note: we tend to use UNIX domain sockets much more than TCP these days, and I don't believe I've ever tested TLS from CalendarServer to Postgres, but it should work if Postgres is configured correctly and you do the right stuff with certs, etc.
To answer your question, I think the adoption of endpoints by CalendarServer was intended to reap the benefits of endpoints over the previous connection handling code, and omission of a separate TLS parameter is a side effect.
-dre