One possible way to use twtxt for private messages would be using http authentication, then it’s private to anyone who’s allowed to see the twtxt.txt file, otherwise the it returns 401 Unauthorized. That’s not exactly an easy solution since both parties need to agree on authentication, and no client is set up for that, but it at least is self-hosted and decentralised :D