If your XKit went missing after enabling the new “SSL Security” setting from Tumblr, it’s because XKit disables itself automatically on pages served using SSL protocol.
The reason for it is pretty simple: before today’s update, the only Tumblr pages served using SSL was the login and settings pages, and both of those pages contain your e-mail and password, so it was a no-brainer to disable XKit on those pages to protect your privacy.
I’m working on a workaround that will let XKit work on SSL, but still protect your privacy, and an update will be made available as soon as possible. In the meanwhile, if you want to use XKit, unfortunately, you have to turn off that setting. I apologize about this.
PS: SSL does not exactly provide any additional security unless you use a public network such as the Wi-Fi at your local Starbucks or your workplace’s internet connection to use Tumblr. It will not protect you from viruses, it prevents people from snooping on the data your computer sends and receives on public places.