Yes steemit definitely needs to host the delegated authority verification: in my opinion an app should be a user towards where u delegate (in this case) posting authority to and which you (as owner) can always instantly revoke access. The allowing and disallowing of this would go thru a steemit.com environment as this is the most user seen and trustworthy location.

I think in this case u would need to share ur posting key (which is the one with least permissions: write and upvote) with squeek.

The platform is still in development but to run trustworthy third party apps i thibk your suggestions and mine are to be implemented :)