As far as I know, you need the active key in order to share posting authority, so with the likes of HiveSigner, you're using your active key to let an app use your posting permissions.

For example, I have given these apps (via SteemConnect) permission to post as me

I agree that it's still not great, but that's the rules of the blockchain. Still, I'd NEVER enter my active key into any site that I don't absolutely 100% trust.