I totally understand your hesitation. One has to be very careful with these things. Always check the domain name when you enter the keys. Watch out for phishing links in comments on Steemit saying something like "This person stole your content" and then there is a proper looking link which is leading to a page that looks like the original but isn't.

Using SteemConnect though is a very good and secure thing. I use it every day.