As you wish. It crossed my mind too and I made some research:
- you only need to provide your posting key to verify your identity, in case this is lost, you don't lose access to your funds, which are managed by the active key
- it opens the official steemconnect.com site, so you don't give your posting key (I hope you used your posting key) to them, but to Steemconnect
- major Steemians, like @pfunk, @utopian-io, are endorsing this (so less likely to be a scam)