Good work! You're right about how a little bit of paranoia can be good for a user. About a week ago, I was met with a prompt from Steemit, to update and generate me a new key. I triple checked the url from inside my browser, then checked on my phone just to make sure it was a legitimate request.
After plugging it in and being given new keys, I updated them across all my backups, before saving it to my saved passwords with 2 factor authentication.
Steemit did ask for my password once but that was only to change everything. I was also shown the "never give out your password" screen as well. Is this something that happens periodically?
User @lovelygirl is definitely some voting scam, got messaged from it the past two days in a row. Again, thank you for your efforts, along with @steemcleaners, and all other spam/scam fighting initiatives. This shows me that the people who can stop scammers will, giving me all the more faith in the Steemit platform.