Just as passionate? Than this post must have definitely triggered something! The aspect of the researchers themselves is indeed something I did not even think about...

Ah SteemConnect. It can indeed be daunting to type in your private key, but SteemConnect has been designed to eliminate exactly that. Steemconnect can, in your place, give third party apps a temporary token that is different from your private keys. With this token, apps can then perform operations such as upvoting, commenting, creating posts etc. This token expires after a certain time and can also be revoked at any moment with the steemconnect app. So in this way SteemConnect is a gateway to almost any application on the blockchain without giving each app your private key to perform the needed operations.

So in this example, debato sends you to the site of SteemConnect where you can authorize the app, and when complete, debato gets an authorization token from SteemConnect (when logging in you can also see what that token can be used for, upvoting, commenting etc.). Then you can use the app to perform operations in your name without ever giving your private keys to that app.

It's a pretty established feature and open source so I do tend to trust it :)