The active key is needed to give the app the authority to post and like on your behalf. What that really means is that when you vote and comment, the app does it for you without you needing to use your posting key. I'm not sure if your active key travels over the net to hivesigner or if it is used locally on your machine to authorise the posting authority. I think it's the latter, but you'd have to ask them. Here's their discord channel - https://discord.gg/n5n5AxD

Regarding Hive.blog, I don't use it, but if they are asking for your posting key, they are probably storing it on their server, which is WAY less safe than using your active key to authorise 3Speak (via hivesigner) to post and vote on your behalf.

The best approach is to use Peakd.com as your blogging platform and use Hive Keychain to manage your keys and posting etc. With it no keys ever leave your local machine.