Xapo is legit, I've used it when I first started with Bitcoin and wasn't comfortable with wallets and private keys. I trust them but their security sometimes is very annoying to say the least. To send 0.001 BTC you basically need to deactivate a nuclear bomb: 2FA (never worked in my case), email confirmations, sms codes that never arrive (1 in 4 tries if I remember correctly)....

They are just scaring regular and casual users away, even if what the goal is to make Bitcoin more user friendly. Google Play or Paypal are a breeze in comparison and that's what they should aim for.

If they are not going to provide private keys to your customers at least they need to provide a seamless product and service.