What I don't understand, I thought reverse engineering of protocols for interoperability is explicitly allowed in most of the relevant laws (one of the few good things), so does hammerhead even need a licence to implement the functionality?
Yes, and in fact ANT Private (proprietary protocol) has been reverse engineered before. But this is kind of new territory for these manufacturers, and Shimano tends to be quite litigious. In fact the reverse engineering attempt I remember has all but been scraped from the internet: https://hackaday.com/2019/03/26/reverse-engineering-shimano-....
Looks like internet archive has a copy of the linked github page. Seems like it has everything needed, including the network key, to get things working. If you want to risk a legal fight with Shimano, that is.
My reading of the OP and the video posted elsewhere in the thread is that in building support for the proprietary extensions used by Di2 Hammerhead entered into a licensing agreement and was granted access to non-public Shimano documentation. So while it would probably be legal for them to RE the Di2 extensions, that would be legally different than continuing to distribute software developed with Shimano's permission and support.
