I assume they are only asking for the private posting key? This would still mean your Steem/Steempower/SBD would be safe in the event that it somehow became public wouldn't it? It isn't possible to change the account password or transfer funds without the master key is it?