Edit: Thank you for taking time to comment! I wanted to point out that to make a poll no key is required from app. User can use their favorite front-end to complete the publishing by transferring small fund/fee that serves the purpose/against spam attacks. App doesn't have transfer functionality, it has only cast a vote which is done safely only on browser and can surely be done by user's choice of front-end as well. Please check @steempoll posts that have instructions when user opens post from Steemit or busy or eSteem. They either cast a vote right there or visit website to check results and cast a vote there.
Yes as I mentioned in post, results by stake will also be added, right now you can create only by vote other option is disabled, for now until implementation is ready.
As for sybil attack, security can be improved by increasing fee, imo with reputation check inclusion can help as well.
I am not entirely sure what Dan meant by using custom_json for transaction, I have used it before and I don't see how it is suitable for this application, perhaps someone can enlighten me please if they see the way. :) I will wait his comment to see if he gives some direction.