As far as I know, you need the active
key in order to share posting
authority, so with the likes of HiveSigner, you're using your active
key to let an app use your posting
permissions.
For example, I have given these apps (via SteemConnect) permission to post as me
I agree that it's still not great, but that's the rules of the blockchain. Still, I'd NEVER enter my active key into any site that I don't absolutely 100% trust.
If using hivesigher, I think it's ok. But some ask to put the active key directly on their websites.
If you're talking about
PeakD
viaPeakLock
, they use it to sign transactions (involving money), if there are any other sites doing it, I'm not too sure.