We are actively working on SteemConnect, which as you noted is due by Q3.

The point of building that is to prevent apps from handling private keys in general. Too many services have handled user keys or held user funds and been compromised, so we want to avoid building features that encourage that usage.

That said, for just a posting key, and just for a few months until SteemConnect 2 launches, I think a QR is a good temporary measure (as long as anyone using it to import keys promises to switch over to using SteemConnect when it's ready). I'll see about getting this implemented.