Consider steemit.com for example: for the most part, the majority of us are more than happy to trust Steemit Inc. to safely manage our private keys. Since Dan and Ned have a tremendous amount of time and money invested into this project, it doesn't make sense for them to abuse our private keys, since they could realize far more dramatic personal gains by maintaining the integrity and security of this quickly growing (exploding!) platform.
However, as 
How can we trust third-party applications with the use of our private keys? Unless you are simply investing in steem power and banking on the value exploding, then the whole point of this specific proof of work algorithm is to have the full weight of your stake in steem power in your account. Offline storage of your steem power will not work for example to secure your account, because the whole point is to have your account online for the curation benefits and voting influence. Thus, we will have to trust third-party apps (if we intend to do so) with at the very least our private posting keys.
I can imagine, for example, a small company that develops a specific set of software routines for blogs and other third-party apps specifically for secure key management and interaction with the Steem blockchain. This company could be given read access to the app/site source to do random checks and verify that their programs are in fact being used and have not been altered. This reputation-management company would issue their stamp of approval for the different services that they work with, which I anticipate would be a straightforward way to boost confidence in the apps and websites. If they found violations, this company could blacklist the offending site, severely damaging their reputation.
