You are right and wrong.

Seems like you don't know yes that there is an option for custom JSON to require either either the posting key or the active key for signature. Most custom JSONs on HE that move money around require active key authority. I've actually tested this functionality myself with the API.