fiatjaf on Nostr: You trust it with the ability to sign stuff on your behalf, but it doesn't get your ...

You trust it with the ability to sign stuff on your behalf, but it doesn't get your key. You can remove its access anytime you want.

The entire point is to allow a kind of delegation that doesn't require lending your key to others, nor breaking the network (other people don't have to know you've setup some arcane and stupid delegation mechanism). But yes, like any delegation mechanism (and any of the dozens of delegation proposals we've seen in Nostr) at the time you delegate to someone, they are trusted to some extent.

The magic of Pomegranate is that you can revoke that trust any time you want.