SSL support is available on all Typekit plans. The Typekit embed code is protocol-relative:

<script type="text/javascript" src="//use.typekit.net/xxxxxx.js"></script>
<script type="text/javascript">try{Typekit.load();}catch(e){}</script>

If the page is being served over HTTP, then the JavaScript and fonts will load over HTTP; if the page is served over HTTPS, then the JavaScript and fonts will be, too.

Prior to July 2012, the embed code included a protocol:

<script type="text/javascript" src="http://use.typekit.com/xxxxxx.js"></script>
<script type="text/javascript">try{Typekit.load();}catch(e){}</script>

To serve fonts securely on older sites, you can either change the protocol to https or update the site to the protocol-relative embed code. To find the embed code for your kit, launch your Kit Editor, and click the "embed code" link at the top right.