Seems like they use SteemConnect.com to authenticate their users. I've recently created a discussion board integrated with steem and do also use SteemConnect. So basically you don't need to give away your keys and you can revoke access to certain apps. Still SteemConnect is a foreign provider with access to your keys, but as they are operated by Steemit and Busy, they have good reputation.