If we can't trust giving the private posting key to third party apps, then there is not point in having it, not the key hierarchy...

And for as long as Steem connect requires 3 clicks and a separate password to use, I would rather have apps ask for a posting key (while ideally, but not necessarily, also offering Steem connect and Keychain as an option for those who want that).

Storing the private posting key of users have many advantages for convenience to allow posting after a Steem node has been down without requiring a new tx to be signed.

If we can't provide that level of convenience, then we may as well forget being a social platform..