This is an interesting problem ;)
The idea here is that if you used a protocol to clone the main project, then that protocol should also work for all the dependencies. And that assumption was working well for github.
If this check for the 'ssh://' prefix works for you (and I think it should work), then I don't see any problems with adopting it.
A better way would be to always override the protocol handler if the git_protocol option is specified on the command line (so we would completely disregard the parent url in this case). Unfortunately, waf cannot tell us if an option was actually present on the cmd line, we just get the default value if it was not.