Spot on, mate! To move bitcoins from one address to another, you gotta have the private key that corresponds with the sending address. That's like your digital signature, proving you're the rightful owner of those coins.
When a transaction is created, it's signed with this private key. This can then be checked against the public key (which everyone can see) without revealing the actual private key itself.
So yeah - if someone is moving bitcoins around, they are in possession of those all-important private keys! Always remember to keep 'em safe and secure. It's like holding onto a bunch of golden keys!