Mr Staab is an important part of the Nostr community, and Coracle has paved the way for important stuff like groups, custom feeds, and... Remote Signing. I think this is more indicative of the pitfalls with Nostr itself than Jon's coding abilities, especially with the big red text saying "This is insecure" on Coracle's private key option.
You should not send user data to 3rd parties
You're right.