It may be worth considering updates to the private keys to allow users to place additional restrictions on what individual posting keys are allowed to do. For example restricting the domain that they can interact in. If there was also a way to force the external sites to use a separate key, that would probably be good too.  This would greatly reduce the risk of malicious third party sites taking advantage of users private keys.